Fix CVE caused by jetty-http introduced in spark-core (#508) (#509)

(cherry picked from commit 9cb89f6) Signed-off-by: Zan Niu <[email protected]> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-project · Jan 31, 2025 · 5da556a · 5da556a
1 parent 55d41d5
commit 5da556a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/build.gradle b/build.gradle
@@ -222,7 +222,8 @@ task addSparkJar(type: Copy) {
         }
         // Remove the unwanted directory from jar B
         delete file("${jarBContents}/org/apache/spark/unused")
-
+        delete file("${jarBContents}/org/sparkproject/jetty/http")
+        delete file("${jarBContents}/META-INF/maven/org.eclipse.jetty/jetty-http")
         // Re-compress jar B
         ant.zip(destfile: jarB, baseDir: jarBContents)