From 5ac5460767712ef6a44f126869cbebe7d63d946d Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Tue, 7 Nov 2023 13:08:09 +0800
Subject: [PATCH 01/19] SPARK-45522: Bump jetty to v10

---
 core/pom.xml                                             | 5 -----
 core/src/main/scala/org/apache/spark/ui/JettyUtils.scala | 4 +++-
 pom.xml                                                  | 8 +-------
 3 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/core/pom.xml b/core/pom.xml
index c093213bd6b94..4792122d72f9d 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -146,11 +146,6 @@
       <artifactId>jetty-http</artifactId>
       <scope>compile</scope>
     </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-continuation</artifactId>
-      <scope>compile</scope>
-    </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-servlet</artifactId>
diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index 849ee14c0afb4..aec0b6379b84f 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -204,7 +204,7 @@ private[spark] object JettyUtils extends Logging {
         // SPARK-21176: Use the Jetty logic to calculate the number of selector threads (#CPUs/2),
         // but limit it to 8 max.
         val numSelectors = math.max(1, math.min(8, Runtime.getRuntime().availableProcessors() / 2))
-        new HttpClient(new HttpClientTransportOverHTTP(numSelectors), null)
+        new HttpClient(new HttpClientTransportOverHTTP(numSelectors))
       }
 
       override def filterServerResponseHeader(
@@ -325,8 +325,10 @@ private[spark] object JettyUtils extends Logging {
 
       // If SSL is configured, create the secure connector first.
       val securePort = sslOptions.createJettySslContextFactory().map { factory =>
+
         val securePort = sslOptions.port.getOrElse(if (port > 0) Utils.userPort(port, 400) else 0)
         val secureServerName = if (serverName.nonEmpty) s"$serverName (HTTPS)" else serverName
+
         val connectionFactories = AbstractConnectionFactory.getFactories(factory,
           new HttpConnectionFactory(httpConfig))
 
diff --git a/pom.xml b/pom.xml
index e290273543c63..6bbc2c8b42a30 100644
--- a/pom.xml
+++ b/pom.xml
@@ -143,7 +143,7 @@
     <parquet.version>1.13.1</parquet.version>
     <orc.version>1.9.2</orc.version>
     <orc.classifier>shaded-protobuf</orc.classifier>
-    <jetty.version>9.4.53.v20231009</jetty.version>
+    <jetty.version>10.0.18</jetty.version>
     <jakartaservlet.version>4.0.3</jakartaservlet.version>
     <chill.version>0.10.0</chill.version>
     <!--
@@ -489,12 +489,6 @@
         <version>${jetty.version}</version>
         <scope>provided</scope>
       </dependency>
-      <dependency>
-        <groupId>org.eclipse.jetty</groupId>
-        <artifactId>jetty-continuation</artifactId>
-        <version>${jetty.version}</version>
-        <scope>provided</scope>
-      </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-servlet</artifactId>

From 59809f6e43c1a4bd0ebffd7c781d560e7050b685 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Tue, 7 Nov 2023 17:18:32 +0800
Subject: [PATCH 02/19] SPARK-45522: Updat ssl server changes

---
 core/src/main/scala/org/apache/spark/SSLOptions.scala    | 2 +-
 core/src/main/scala/org/apache/spark/ui/JettyUtils.scala | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/src/main/scala/org/apache/spark/SSLOptions.scala b/core/src/main/scala/org/apache/spark/SSLOptions.scala
index 26108d885e4c7..ce058cec26866 100644
--- a/core/src/main/scala/org/apache/spark/SSLOptions.scala
+++ b/core/src/main/scala/org/apache/spark/SSLOptions.scala
@@ -87,7 +87,7 @@ private[spark] case class SSLOptions(
   /**
    * Creates a Jetty SSL context factory according to the SSL settings represented by this object.
    */
-  def createJettySslContextFactory(): Option[SslContextFactory] = {
+  def createJettySslContextFactoryServer(): Option[SslContextFactory.Server] = {
     if (enabled) {
       val sslContextFactory = new SslContextFactory.Server()
 
diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index aec0b6379b84f..a43d2b20cd80c 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -324,7 +324,7 @@ private[spark] object JettyUtils extends Logging {
       httpConfig.setSendXPoweredBy(false)
 
       // If SSL is configured, create the secure connector first.
-      val securePort = sslOptions.createJettySslContextFactory().map { factory =>
+      val securePort = sslOptions.createJettySslContextFactoryServer().map { factory =>
 
         val securePort = sslOptions.port.getOrElse(if (port > 0) Utils.userPort(port, 400) else 0)
         val secureServerName = if (serverName.nonEmpty) s"$serverName (HTTPS)" else serverName

From 3f519ca1237396368a80f91a68f9f24b2dbe6fde Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Sun, 21 Jan 2024 19:11:38 +0800
Subject: [PATCH 03/19] POM clean up

---
 LICENSE-binary | 1 -
 core/pom.xml   | 3 +--
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/LICENSE-binary b/LICENSE-binary
index c6f291f110880..2073d85246b68 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -368,7 +368,6 @@ xerces:xercesImpl
 org.codehaus.jackson:jackson-jaxrs
 org.codehaus.jackson:jackson-xc
 org.eclipse.jetty:jetty-client
-org.eclipse.jetty:jetty-continuation
 org.eclipse.jetty:jetty-http
 org.eclipse.jetty:jetty-io
 org.eclipse.jetty:jetty-jndi
diff --git a/core/pom.xml b/core/pom.xml
index 4792122d72f9d..f780551fb5552 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -533,7 +533,7 @@
               <overWriteIfNewer>true</overWriteIfNewer>
               <useSubDirectoryPerType>true</useSubDirectoryPerType>
               <includeArtifactIds>
-                guava,protobuf-java,jetty-io,jetty-servlet,jetty-servlets,jetty-continuation,jetty-http,jetty-plus,jetty-util,jetty-server,jetty-security,jetty-proxy,jetty-client
+                guava,protobuf-java,jetty-io,jetty-servlet,jetty-servlets,jetty-http,jetty-plus,jetty-util,jetty-server,jetty-security,jetty-proxy,jetty-client
               </includeArtifactIds>
               <silent>true</silent>
             </configuration>
@@ -553,7 +553,6 @@
               <include>org.eclipse.jetty:jetty-http</include>
               <include>org.eclipse.jetty:jetty-proxy</include>
               <include>org.eclipse.jetty:jetty-client</include>
-              <include>org.eclipse.jetty:jetty-continuation</include>
               <include>org.eclipse.jetty:jetty-servlet</include>
               <include>org.eclipse.jetty:jetty-servlets</include>
               <include>org.eclipse.jetty:jetty-plus</include>

From 1ba384c0a7fb7187566e16f9c1802a4444825e2f Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Tue, 23 Jan 2024 00:18:21 +0800
Subject: [PATCH 04/19] Remove connector.setStopTimeout as Jetty rely on
 graceful shutdown instead

---
 core/src/main/scala/org/apache/spark/ui/JettyUtils.scala | 1 -
 1 file changed, 1 deletion(-)

diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index a43d2b20cd80c..c489e1d010264 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -300,7 +300,6 @@ private[spark] object JettyUtils extends Logging {
         connector.setReuseAddress(!Utils.isWindows)
          // spark-45248: set the idle timeout to prevent slow DoS
         connector.setIdleTimeout(8000)
-        connector.setStopTimeout(stopTimeout)
 
         // Currently we only use "SelectChannelConnector"
         // Limit the max acceptor number to 8 so that we don't waste a lot of threads

From 786fd60cb0e8ad7f66411a01a5135dbf00d7a8c4 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Tue, 23 Jan 2024 20:36:54 +0800
Subject: [PATCH 05/19] Update ssl factory

---
 .../apache/hive/service/cli/thrift/ThriftHttpCLIService.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
index 140a3fb8954dc..ff48584041b75 100644
--- a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
+++ b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
@@ -84,7 +84,7 @@ protected void initializeServer() {
           throw new IllegalArgumentException(ConfVars.HIVE_SERVER2_SSL_KEYSTORE_PATH.varname
               + " Not configured for SSL connection");
         }
-        SslContextFactory sslContextFactory = new SslContextFactory.Server();
+        SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
         String[] excludedProtocols = hiveConf.getVar(ConfVars.HIVE_SSL_PROTOCOL_BLACKLIST).split(",");
         LOG.info("HTTP Server SSL: adding excluded protocols: " + Arrays.toString(excludedProtocols));
         sslContextFactory.addExcludeProtocols(excludedProtocols);

From e5b86c16d9504aefa50144e8859da34c015e3c27 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Wed, 24 Jan 2024 23:11:22 +0800
Subject: [PATCH 06/19] Fix redirect use case

---
 .../src/main/scala/org/apache/spark/TestUtils.scala | 13 +++++++++++++
 .../test/scala/org/apache/spark/ui/UISuite.scala    |  6 +++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/core/src/main/scala/org/apache/spark/TestUtils.scala b/core/src/main/scala/org/apache/spark/TestUtils.scala
index e85f98ff55c55..3bb8b000ad225 100644
--- a/core/src/main/scala/org/apache/spark/TestUtils.scala
+++ b/core/src/main/scala/org/apache/spark/TestUtils.scala
@@ -252,6 +252,19 @@ private[spark] object TestUtils extends SparkTestUtils {
     }
   }
 
+  /**
+   * Returns the Location header from an HTTP(S) URL.
+   */
+  def redirectUrl(
+                        url: URL,
+                        method: String = "GET",
+                        headers: Seq[(String, String)] = Nil): String = {
+    withHttpConnection(url, method, headers = headers) { connection =>
+      connection.getHeaderField("Location");
+    }
+  }
+
+
   /**
    * Returns the response message from an HTTP(S) URL.
    */
diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index e7d57a6e6def9..2d7b85e404250 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -401,9 +401,9 @@ class UISuite extends SparkFunSuite {
 
       assert(TestUtils.httpResponseCode(new URL(urlStr + "/")) === HttpServletResponse.SC_OK)
 
-      // If the following assertion fails when we upgrade Jetty, it seems to change the behavior of
-      // handling context path which doesn't have the trailing slash.
-      assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_OK)
+      // In the case of trailing slash, 302 should be return and the redirect URL shouuld be part of the header.
+      assert(TestUtils.redirectUrl(new URL(urlStr)) === proxyRoot + "/ctx/");
+      assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_FOUND)
     } finally {
       stopServer(serverInfo)
     }

From d0699a04986173459ac4fcd6350e700beb51ec53 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Wed, 24 Jan 2024 23:17:22 +0800
Subject: [PATCH 07/19] Revert 34449 test, as the redirect behaviour is now
 restored on Jetty 10

---
 .../scala/org/apache/spark/ui/UISuite.scala   | 55 +++++++++++--------
 1 file changed, 33 insertions(+), 22 deletions(-)

diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index 2d7b85e404250..0c3e7950cbe81 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -359,9 +359,20 @@ class UISuite extends SparkFunSuite {
     try {
       val serverAddr = s"http://$localhost:${serverInfo.boundPort}"
 
+      val (_, ctx) = newContext("/ctx1")
+      serverInfo.addHandler(ctx, securityMgr)
+
       val redirect = JettyUtils.createRedirectHandler("/src", "/dst")
       serverInfo.addHandler(redirect, securityMgr)
 
+      // Test Jetty's built-in redirect to add the trailing slash to the context path.
+      TestUtils.withHttpConnection(new URL(s"$serverAddr/ctx1")) { conn =>
+        assert(conn.getResponseCode() === HttpServletResponse.SC_FOUND)
+        val location = Option(conn.getHeaderFields().get("Location"))
+          .map(_.get(0)).orNull
+        assert(location === s"$proxyRoot/ctx1/")
+      }
+
       // Test with a URL handled by the added redirect handler, and also including a path prefix.
       val headers = Seq("X-Forwarded-Context" -> "/prefix")
       TestUtils.withHttpConnection(
@@ -386,28 +397,28 @@ class UISuite extends SparkFunSuite {
       stopServer(serverInfo)
     }
   }
-
-  test("SPARK-34449: Jetty 9.4.35.v20201120 and later no longer return status code 302 " +
-       " and handle internally when request URL ends with a context path without trailing '/'") {
-    val proxyRoot = "https://proxy.example.com:443/prefix"
-    val (conf, securityMgr, sslOptions) = sslDisabledConf()
-    conf.set(UI.PROXY_REDIRECT_URI, proxyRoot)
-    val serverInfo = JettyUtils.startJettyServer("0.0.0.0", 0, sslOptions, conf)
-
-    try {
-      val (_, ctx) = newContext("/ctx")
-      serverInfo.addHandler(ctx, securityMgr)
-      val urlStr = s"http://$localhost:${serverInfo.boundPort}/ctx"
-
-      assert(TestUtils.httpResponseCode(new URL(urlStr + "/")) === HttpServletResponse.SC_OK)
-
-      // In the case of trailing slash, 302 should be return and the redirect URL shouuld be part of the header.
-      assert(TestUtils.redirectUrl(new URL(urlStr)) === proxyRoot + "/ctx/");
-      assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_FOUND)
-    } finally {
-      stopServer(serverInfo)
-    }
-  }
+//
+//  test("SPARK-34449: Jetty 9.4.35.v20201120 and later no longer return status code 302 " +
+//       " and handle internally when request URL ends with a context path without trailing '/'") {
+//    val proxyRoot = "https://proxy.example.com:443/prefix"
+//    val (conf, securityMgr, sslOptions) = sslDisabledConf()
+//    conf.set(UI.PROXY_REDIRECT_URI, proxyRoot)
+//    val serverInfo = JettyUtils.startJettyServer("0.0.0.0", 0, sslOptions, conf)
+//
+//    try {
+//      val (_, ctx) = newContext("/ctx")
+//      serverInfo.addHandler(ctx, securityMgr)
+//      val urlStr = s"http://$localhost:${serverInfo.boundPort}/ctx"
+//
+//      assert(TestUtils.httpResponseCode(new URL(urlStr + "/")) === HttpServletResponse.SC_OK)
+//
+//      // In the case of trailing slash, 302 should be return and the redirect URL shouuld be part of the header.
+//      assert(TestUtils.redirectUrl(new URL(urlStr)) === proxyRoot + "/ctx/");
+//      assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_FOUND)
+//    } finally {
+//      stopServer(serverInfo)
+//    }
+//  }
 
   test("SPARK-34449: default thread pool size of different jetty servers") {
     val (conf, _, sslOptions) = sslDisabledConf()

From 29381f559894d053daa8bef136c703de76b767e4 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Thu, 25 Jan 2024 16:46:18 +0800
Subject: [PATCH 08/19] Test case on proxy

---
 core/src/test/scala/org/apache/spark/ui/UISuite.scala | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index 0c3e7950cbe81..16ded1e0edd6d 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -310,15 +310,20 @@ class UISuite extends SparkFunSuite {
       val httpPort = serverInfo.boundPort
 
       val tests = Seq(
-        ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND),
-        ("https", serverInfo.securePort.get, HttpServletResponse.SC_OK))
+//        ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND))
+      // Failed on HTTPS
+      ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND),
+      ("https", serverInfo.securePort.get, HttpServletResponse.SC_OK))
 
       tests.foreach { case (scheme, port, expected) =>
         val urls = Seq(
-          s"$scheme://$localhost:$port/root",
+//          s"$scheme://$localhost:$port/root",
           s"$scheme://$localhost:$port/test1/root",
           s"$scheme://$localhost:$port/test2/root")
         urls.foreach { url =>
+
+//          val message = TestUtils.httpResponseMessage(new URL(url))
+//          assert(message === "test")
           val rc = TestUtils.httpResponseCode(new URL(url))
           assert(rc === expected, s"Unexpected status $rc for $url")
         }

From d179d89b794ea785db85c523807dc8708a39ed83 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Fri, 26 Jan 2024 15:38:53 +0800
Subject: [PATCH 09/19] SPARK-45522: Update test cases

---
 core/src/main/scala/org/apache/spark/ui/JettyUtils.scala | 5 +++++
 core/src/test/scala/org/apache/spark/ui/UISuite.scala    | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index c489e1d010264..8cdcec7b0122a 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -325,6 +325,11 @@ private[spark] object JettyUtils extends Logging {
       // If SSL is configured, create the secure connector first.
       val securePort = sslOptions.createJettySslContextFactoryServer().map { factory =>
 
+        // spark-45522: SniHostCheck defaulted to true since Jetty 10, this will affect the standalone deployment.
+        val src = new SecureRequestCustomizer()
+        src.setSniHostCheck(false)
+        httpConfig.addCustomizer(src)
+
         val securePort = sslOptions.port.getOrElse(if (port > 0) Utils.userPort(port, 400) else 0)
         val secureServerName = if (serverName.nonEmpty) s"$serverName (HTTPS)" else serverName
 
diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index 16ded1e0edd6d..d6833af428492 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -317,7 +317,8 @@ class UISuite extends SparkFunSuite {
 
       tests.foreach { case (scheme, port, expected) =>
         val urls = Seq(
-//          s"$scheme://$localhost:$port/root",
+//          s"$scheme://$localhost:$port/test3")
+          s"$scheme://$localhost:$port/root",
           s"$scheme://$localhost:$port/test1/root",
           s"$scheme://$localhost:$port/test2/root")
         urls.foreach { url =>

From 4b7e4659fcba9885e76386185f3bb661eca3fed3 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Fri, 26 Jan 2024 15:47:39 +0800
Subject: [PATCH 10/19] SPARK-45522: Update test

---
 .../scala/org/apache/spark/ui/UISuite.scala   | 49 +++++++++----------
 1 file changed, 22 insertions(+), 27 deletions(-)

diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index d6833af428492..b26c6b178ddbc 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -310,21 +310,16 @@ class UISuite extends SparkFunSuite {
       val httpPort = serverInfo.boundPort
 
       val tests = Seq(
-//        ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND))
-      // Failed on HTTPS
       ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND),
       ("https", serverInfo.securePort.get, HttpServletResponse.SC_OK))
 
       tests.foreach { case (scheme, port, expected) =>
         val urls = Seq(
-//          s"$scheme://$localhost:$port/test3")
           s"$scheme://$localhost:$port/root",
           s"$scheme://$localhost:$port/test1/root",
           s"$scheme://$localhost:$port/test2/root")
         urls.foreach { url =>
 
-//          val message = TestUtils.httpResponseMessage(new URL(url))
-//          assert(message === "test")
           val rc = TestUtils.httpResponseCode(new URL(url))
           assert(rc === expected, s"Unexpected status $rc for $url")
         }
@@ -403,28 +398,28 @@ class UISuite extends SparkFunSuite {
       stopServer(serverInfo)
     }
   }
-//
-//  test("SPARK-34449: Jetty 9.4.35.v20201120 and later no longer return status code 302 " +
-//       " and handle internally when request URL ends with a context path without trailing '/'") {
-//    val proxyRoot = "https://proxy.example.com:443/prefix"
-//    val (conf, securityMgr, sslOptions) = sslDisabledConf()
-//    conf.set(UI.PROXY_REDIRECT_URI, proxyRoot)
-//    val serverInfo = JettyUtils.startJettyServer("0.0.0.0", 0, sslOptions, conf)
-//
-//    try {
-//      val (_, ctx) = newContext("/ctx")
-//      serverInfo.addHandler(ctx, securityMgr)
-//      val urlStr = s"http://$localhost:${serverInfo.boundPort}/ctx"
-//
-//      assert(TestUtils.httpResponseCode(new URL(urlStr + "/")) === HttpServletResponse.SC_OK)
-//
-//      // In the case of trailing slash, 302 should be return and the redirect URL shouuld be part of the header.
-//      assert(TestUtils.redirectUrl(new URL(urlStr)) === proxyRoot + "/ctx/");
-//      assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_FOUND)
-//    } finally {
-//      stopServer(serverInfo)
-//    }
-//  }
+
+  test("SPARK-45522: Jetty 10 and above shouuld return status code 302 with correct redirect url" +
+    " when request URL ends with a context path without trailing '/'") {
+    val proxyRoot = "https://proxy.example.com:443/prefix"
+    val (conf, securityMgr, sslOptions) = sslDisabledConf()
+    conf.set(UI.PROXY_REDIRECT_URI, proxyRoot)
+    val serverInfo = JettyUtils.startJettyServer("0.0.0.0", 0, sslOptions, conf)
+
+    try {
+      val (_, ctx) = newContext("/ctx")
+      serverInfo.addHandler(ctx, securityMgr)
+      val urlStr = s"http://$localhost:${serverInfo.boundPort}/ctx"
+
+      assert(TestUtils.httpResponseCode(new URL(urlStr + "/")) === HttpServletResponse.SC_OK)
+
+      // In the case of trailing slash, 302 should be return and the redirect URL shouuld be part of the header.
+      assert(TestUtils.redirectUrl(new URL(urlStr)) === proxyRoot + "/ctx/");
+      assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_FOUND)
+    } finally {
+      stopServer(serverInfo)
+    }
+  }
 
   test("SPARK-34449: default thread pool size of different jetty servers") {
     val (conf, _, sslOptions) = sslDisabledConf()

From 749c02d0b6f06993b563179509d9068ad843f50a Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Fri, 26 Jan 2024 15:49:07 +0800
Subject: [PATCH 11/19] SPARK-45522: Update code naming

---
 .../service/cli/thrift/ThriftHttpCLIService.java     | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
index ff48584041b75..3fe60aa681f9e 100644
--- a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
+++ b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
@@ -84,16 +84,16 @@ protected void initializeServer() {
           throw new IllegalArgumentException(ConfVars.HIVE_SERVER2_SSL_KEYSTORE_PATH.varname
               + " Not configured for SSL connection");
         }
-        SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
+        SslContextFactory.Server sslContextFactoryServer = new SslContextFactory.Server();
         String[] excludedProtocols = hiveConf.getVar(ConfVars.HIVE_SSL_PROTOCOL_BLACKLIST).split(",");
         LOG.info("HTTP Server SSL: adding excluded protocols: " + Arrays.toString(excludedProtocols));
-        sslContextFactory.addExcludeProtocols(excludedProtocols);
+        sslContextFactoryServer.addExcludeProtocols(excludedProtocols);
         LOG.info("HTTP Server SSL: SslContextFactory.getExcludeProtocols = " +
-          Arrays.toString(sslContextFactory.getExcludeProtocols()));
-        sslContextFactory.setKeyStorePath(keyStorePath);
-        sslContextFactory.setKeyStorePassword(keyStorePassword);
+          Arrays.toString(sslContextFactoryServer.getExcludeProtocols()));
+        sslContextFactoryServer.setKeyStorePath(keyStorePath);
+        sslContextFactoryServer.setKeyStorePassword(keyStorePassword);
         connectionFactories = AbstractConnectionFactory.getFactories(
-            sslContextFactory, new HttpConnectionFactory());
+            sslContextFactoryServer, new HttpConnectionFactory());
       } else {
         connectionFactories = new ConnectionFactory[] { new HttpConnectionFactory() };
       }

From 744314987ec5fa6d8caba21e19e1cd3fac8a5e19 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Fri, 26 Jan 2024 16:06:33 +0800
Subject: [PATCH 12/19] Update code comment

---
 core/src/main/scala/org/apache/spark/ui/JettyUtils.scala | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index 8cdcec7b0122a..a1d86bfc280c5 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -325,7 +325,8 @@ private[spark] object JettyUtils extends Logging {
       // If SSL is configured, create the secure connector first.
       val securePort = sslOptions.createJettySslContextFactoryServer().map { factory =>
 
-        // spark-45522: SniHostCheck defaulted to true since Jetty 10, this will affect the standalone deployment.
+        // spark-45522: SniHostCheck defaulted to true since Jetty 10,
+        // this will affect the standalone deployment.
         val src = new SecureRequestCustomizer()
         src.setSniHostCheck(false)
         httpConfig.addCustomizer(src)

From 73c61272e172e6406a4d8b2c7f236ceafc221dbc Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Fri, 26 Jan 2024 16:10:23 +0800
Subject: [PATCH 13/19] Minimise the code diff

---
 core/src/test/scala/org/apache/spark/ui/UISuite.scala | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index b26c6b178ddbc..b38026339553e 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -310,8 +310,8 @@ class UISuite extends SparkFunSuite {
       val httpPort = serverInfo.boundPort
 
       val tests = Seq(
-      ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND),
-      ("https", serverInfo.securePort.get, HttpServletResponse.SC_OK))
+        ("http", serverInfo.boundPort, HttpServletResponse.SC_FOUND),
+        ("https", serverInfo.securePort.get, HttpServletResponse.SC_OK))
 
       tests.foreach { case (scheme, port, expected) =>
         val urls = Seq(
@@ -319,7 +319,6 @@ class UISuite extends SparkFunSuite {
           s"$scheme://$localhost:$port/test1/root",
           s"$scheme://$localhost:$port/test2/root")
         urls.foreach { url =>
-
           val rc = TestUtils.httpResponseCode(new URL(url))
           assert(rc === expected, s"Unexpected status $rc for $url")
         }

From aa5b1ee68a9db3741c5d3e669d9d8f64ec4ac696 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Fri, 26 Jan 2024 16:47:52 +0800
Subject: [PATCH 14/19] Update code comment

---
 core/src/test/scala/org/apache/spark/ui/UISuite.scala | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/src/test/scala/org/apache/spark/ui/UISuite.scala b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
index b38026339553e..cb5fbda3e58a9 100644
--- a/core/src/test/scala/org/apache/spark/ui/UISuite.scala
+++ b/core/src/test/scala/org/apache/spark/ui/UISuite.scala
@@ -412,7 +412,8 @@ class UISuite extends SparkFunSuite {
 
       assert(TestUtils.httpResponseCode(new URL(urlStr + "/")) === HttpServletResponse.SC_OK)
 
-      // In the case of trailing slash, 302 should be return and the redirect URL shouuld be part of the header.
+      // In the case of trailing slash,
+      // 302 should be return and the redirect URL shouuld be part of the header.
       assert(TestUtils.redirectUrl(new URL(urlStr)) === proxyRoot + "/ctx/");
       assert(TestUtils.httpResponseCode(new URL(urlStr)) === HttpServletResponse.SC_FOUND)
     } finally {

From 398c259b476a9b6e13a123217cc1cee4d70ff427 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Sat, 27 Jan 2024 13:53:09 +0800
Subject: [PATCH 15/19] Test-dependecies.sh to comply with new Jetty version
 format

---
 dev/test-dependencies.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev/test-dependencies.sh b/dev/test-dependencies.sh
index 855572dbc637a..175f59a700941 100755
--- a/dev/test-dependencies.sh
+++ b/dev/test-dependencies.sh
@@ -51,7 +51,7 @@ OLD_VERSION=$($MVN -q \
 # dependency:get for guava and jetty-io are workaround for SPARK-37302.
 GUAVA_VERSION=$(build/mvn help:evaluate -Dexpression=guava.version -q -DforceStdout | grep -E "^[0-9.]+$")
 build/mvn dependency:get -Dartifact=com.google.guava:guava:${GUAVA_VERSION} -q
-JETTY_VERSION=$(build/mvn help:evaluate -Dexpression=jetty.version -q -DforceStdout | grep -E "^[0-9.]+v[0-9]+")
+JETTY_VERSION=$(build/mvn help:evaluate -Dexpression=jetty.version -q -DforceStdout | grep -E "[0-9]+\.[0-9]+\.[0-9]+")
 build/mvn dependency:get -Dartifact=org.eclipse.jetty:jetty-io:${JETTY_VERSION} -q
 if [ $? != 0 ]; then
     echo -e "Error while getting version string from Maven:\n$OLD_VERSION"

From 1dc6ca854ea4aa7e9fe785380e9b197c42af470b Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Tue, 30 Jan 2024 14:28:02 +0800
Subject: [PATCH 16/19] Update hadoop deps

---
 dev/deps/spark-deps-hadoop-3-hive-2.3 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
index 6220626069af6..6e907101aeedb 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -131,8 +131,8 @@ jersey-container-servlet/2.41//jersey-container-servlet-2.41.jar
 jersey-hk2/2.41//jersey-hk2-2.41.jar
 jersey-server/2.41//jersey-server-2.41.jar
 jettison/1.5.4//jettison-1.5.4.jar
-jetty-util-ajax/9.4.53.v20231009//jetty-util-ajax-9.4.53.v20231009.jar
-jetty-util/9.4.53.v20231009//jetty-util-9.4.53.v20231009.jar
+jetty-util-ajax/10.0.18//jetty-util-ajax-10.0.18.jar
+jetty-util/10.0.18//jetty-util-10.0.18.jar
 jline/2.14.6//jline-2.14.6.jar
 jline/3.22.0//jline-3.22.0.jar
 jna/5.13.0//jna-5.13.0.jar

From 0034d9c018e3088f762b4ed2669004fb04a39f89 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <37996731+HiuKwok@users.noreply.github.com>
Date: Wed, 31 Jan 2024 12:45:32 +0800
Subject: [PATCH 17/19] Spark-45522: Code style

Co-authored-by: Kent Yao <yao@apache.org>
---
 core/src/main/scala/org/apache/spark/TestUtils.scala | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/core/src/main/scala/org/apache/spark/TestUtils.scala b/core/src/main/scala/org/apache/spark/TestUtils.scala
index 3bb8b000ad225..5e3078d7292ba 100644
--- a/core/src/main/scala/org/apache/spark/TestUtils.scala
+++ b/core/src/main/scala/org/apache/spark/TestUtils.scala
@@ -256,9 +256,9 @@ private[spark] object TestUtils extends SparkTestUtils {
    * Returns the Location header from an HTTP(S) URL.
    */
   def redirectUrl(
-                        url: URL,
-                        method: String = "GET",
-                        headers: Seq[(String, String)] = Nil): String = {
+      url: URL,
+      method: String = "GET",
+      headers: Seq[(String, String)] = Nil): String = {
     withHttpConnection(url, method, headers = headers) { connection =>
       connection.getHeaderField("Location");
     }

From 817f517b89a49fe161d919ca9c9481b0d5820811 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <37996731+HiuKwok@users.noreply.github.com>
Date: Wed, 31 Jan 2024 12:45:54 +0800
Subject: [PATCH 18/19] Update code comment

Co-authored-by: YangJie <yangjie01@baidu.com>
---
 core/src/main/scala/org/apache/spark/ui/JettyUtils.scala | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index a1d86bfc280c5..a0f65606e60d0 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -325,7 +325,7 @@ private[spark] object JettyUtils extends Logging {
       // If SSL is configured, create the secure connector first.
       val securePort = sslOptions.createJettySslContextFactoryServer().map { factory =>
 
-        // spark-45522: SniHostCheck defaulted to true since Jetty 10,
+        // SPARK-45522: SniHostCheck defaulted to true since Jetty 10,
         // this will affect the standalone deployment.
         val src = new SecureRequestCustomizer()
         src.setSniHostCheck(false)

From 0b7ecb59459bb6a35ce7c94336c6b68795e9ad69 Mon Sep 17 00:00:00 2001
From: HiuFung Kwok <hiufkwok@gmail.com>
Date: Wed, 31 Jan 2024 12:55:16 +0800
Subject: [PATCH 19/19] Bump jetty hf version

---
 dev/deps/spark-deps-hadoop-3-hive-2.3 | 4 ++--
 pom.xml                               | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
index 6e907101aeedb..92e184c099b31 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -131,8 +131,8 @@ jersey-container-servlet/2.41//jersey-container-servlet-2.41.jar
 jersey-hk2/2.41//jersey-hk2-2.41.jar
 jersey-server/2.41//jersey-server-2.41.jar
 jettison/1.5.4//jettison-1.5.4.jar
-jetty-util-ajax/10.0.18//jetty-util-ajax-10.0.18.jar
-jetty-util/10.0.18//jetty-util-10.0.18.jar
+jetty-util-ajax/10.0.19//jetty-util-ajax-10.0.19.jar
+jetty-util/10.0.19//jetty-util-10.0.19.jar
 jline/2.14.6//jline-2.14.6.jar
 jline/3.22.0//jline-3.22.0.jar
 jna/5.13.0//jna-5.13.0.jar
diff --git a/pom.xml b/pom.xml
index 6bbc2c8b42a30..90162ca909973 100644
--- a/pom.xml
+++ b/pom.xml
@@ -143,7 +143,7 @@
     <parquet.version>1.13.1</parquet.version>
     <orc.version>1.9.2</orc.version>
     <orc.classifier>shaded-protobuf</orc.classifier>
-    <jetty.version>10.0.18</jetty.version>
+    <jetty.version>10.0.19</jetty.version>
     <jakartaservlet.version>4.0.3</jakartaservlet.version>
     <chill.version>0.10.0</chill.version>
     <!--