Fix CVE caused by jetty-http introduced in spark-core

zane-neo · zane-neo · commit a4098a1b07d7 · 2025-01-31T08:03:33.000Z
Signed-off-by: Zan Niu &lt;zaniu@amazon.com&gt;
diff --git a/build.gradle b/build.gradle
@@ -224,7 +224,8 @@ task addSparkJar(type: Copy) {
         }
         // Remove the unwanted directory from jar B
         delete file("${jarBContents}/org/apache/spark/unused")
-
+        delete file("${jarBContents}/org/sparkproject/jetty/http")
+        delete file("${jarBContents}/META-INF/maven/org.eclipse.jetty/jetty-http")
         // Re-compress jar B
         ant.zip(destfile: jarB, baseDir: jarBContents)
 

Original file line number	Diff line number	Diff line change
`@@ -224,7 +224,8 @@ task addSparkJar(type: Copy) {`
`224`	`224`	`}`
`225`	`225`	`// Remove the unwanted directory from jar B`
`226`	`226`	`delete file("${jarBContents}/org/apache/spark/unused")`
`227`		`-`
	`227`	`+ delete file("${jarBContents}/org/sparkproject/jetty/http")`
	`228`	`+ delete file("${jarBContents}/META-INF/maven/org.eclipse.jetty/jetty-http")`
`228`	`229`	`// Re-compress jar B`
`229`	`230`	`ant.zip(destfile: jarB, baseDir: jarBContents)`
`230`	`231`