HBASE-30195 Update Thrift gateway to use new hbase-shaded-thrift in thirdparty

hbase-examples/pom.xml

@@ -110,9 +110,14 @@
       <artifactId>hbase-testing-util</artifactId>
       <scope>test</scope>
     </dependency>
+    <!--
+      Thrift runtime classes come from the relocated/shaded artifact in hbase-thirdparty
+      (org.apache.hbase.thirdparty.org.apache.thrift.*) instead of upstream libthrift. See
+      HBASE-30194 and hbase-thirdparty/hbase-shaded-thrift.
+    -->
     <dependency>
-      <groupId>org.apache.thrift</groupId>
-      <artifactId>libthrift</artifactId>
+      <groupId>org.apache.hbase.thirdparty</groupId>
+      <artifactId>hbase-shaded-thrift</artifactId>
     </dependency>
     <dependency>
       <groupId>commons-io</groupId>

hbase-examples/src/main/java/org/apache/hadoop/hbase/thrift/DemoClient.java

@@ -35,13 +35,14 @@
 import org.apache.hadoop.hbase.thrift.generated.TRowResult;
 import org.apache.hadoop.hbase.util.Bytes;
 import org.apache.hadoop.hbase.util.ClientUtils;
-import org.apache.thrift.protocol.TBinaryProtocol;
-import org.apache.thrift.protocol.TProtocol;
-import org.apache.thrift.transport.TSaslClientTransport;
-import org.apache.thrift.transport.TSocket;
-import org.apache.thrift.transport.TTransport;
 import org.apache.yetus.audience.InterfaceAudience;
 
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TBinaryProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSaslClientTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSocket;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TTransport;
+
 /**
  * See the instructions under hbase-examples/README.txt
  */

hbase-examples/src/main/java/org/apache/hadoop/hbase/thrift/HttpDoAsClient.java

@@ -37,11 +37,6 @@
 import org.apache.hadoop.hbase.thrift.generated.Hbase;
 import org.apache.hadoop.hbase.util.Bytes;
 import org.apache.hadoop.hbase.util.ClientUtils;
-import org.apache.thrift.protocol.TBinaryProtocol;
-import org.apache.thrift.protocol.TProtocol;
-import org.apache.thrift.transport.THttpClient;
-import org.apache.thrift.transport.TSocket;
-import org.apache.thrift.transport.TTransport;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.ietf.jgss.GSSContext;
 import org.ietf.jgss.GSSCredential;
@@ -52,6 +47,12 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TBinaryProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.THttpClient;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSocket;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TTransport;
+
 /**
  * See the instructions under hbase-examples/README.txt
  */

hbase-examples/src/main/java/org/apache/hadoop/hbase/thrift2/DemoClient.java

@@ -35,15 +35,16 @@
 import org.apache.hadoop.hbase.thrift2.generated.TResult;
 import org.apache.hadoop.hbase.util.Bytes;
 import org.apache.hadoop.hbase.util.ClientUtils;
-import org.apache.thrift.TConfiguration;
-import org.apache.thrift.protocol.TBinaryProtocol;
-import org.apache.thrift.protocol.TProtocol;
-import org.apache.thrift.transport.TSaslClientTransport;
-import org.apache.thrift.transport.TSocket;
-import org.apache.thrift.transport.TTransport;
-import org.apache.thrift.transport.layered.TFramedTransport;
 import org.apache.yetus.audience.InterfaceAudience;
 
+import org.apache.hbase.thirdparty.org.apache.thrift.TConfiguration;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TBinaryProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSaslClientTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSocket;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.layered.TFramedTransport;
+
 @InterfaceAudience.Private
 public class DemoClient {
   private static String host = "localhost";

hbase-thrift/pom.xml

@@ -84,9 +84,15 @@
       <groupId>org.apache.hbase</groupId>
       <artifactId>hbase-hadoop-compat</artifactId>
     </dependency>
+    <!--
+      Thrift runtime classes come from the relocated/shaded artifact in hbase-thirdparty
+      (org.apache.hbase.thirdparty.org.apache.thrift.*) instead of upstream libthrift. This
+      avoids the libthrift CVE chain and lets us keep Java 8 / javax.servlet / Apache
+      HttpClient 4.x compatibility regardless of upstream's choices. See HBASE-30194.
+    -->
     <dependency>
-      <groupId>org.apache.thrift</groupId>
-      <artifactId>libthrift</artifactId>
+      <groupId>org.apache.hbase.thirdparty</groupId>
+      <artifactId>hbase-shaded-thrift</artifactId>
     </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
@@ -371,12 +377,15 @@
                     <requireProperty>
                       <property>thrift.version</property>
                       <message>"The Thrift version must be specified."</message>
-                      <regex>0\.14\.1</regex>
+                      <regex>0\.23\.\d+</regex>
                       <regexMessage>-
 -
 [FATAL] ==========================================================================================
-[FATAL] HBase Thrift requires the thrift generator version 0.14.1.
-[FATAL] Setting it to something else needs to be reviewed for wire and behavior compatibility.
+[FATAL] HBase Thrift requires the thrift generator version 0.23.x (matching the libthrift
+[FATAL] runtime shipped in hbase-thirdparty/hbase-shaded-thrift). Setting it to something else
+[FATAL] needs to be reviewed for wire and behavior compatibility, and for source compatibility
+[FATAL] with the maven-replacer-plugin rewrite that retargets generated code to the shaded
+[FATAL] org.apache.hbase.thirdparty.org.apache.thrift namespace.
 [FATAL] ==========================================================================================
 -
 -</regexMessage>
@@ -450,6 +459,42 @@
               </execution>
             </executions>
           </plugin>
+          <!--
+            After the Thrift IDL compiler regenerates Java sources under src/main/java/.../generated,
+            rewrite the `import org.apache.thrift.*` lines (and qualified references) to point at
+            the relocated namespace used by org.apache.hbase.thirdparty:hbase-shaded-thrift. The
+            committed generated sources are expected to already contain the rewritten imports;
+            this step keeps the in-tree files in sync after a regeneration. The regex is
+            idempotent: it leaves any already-shaded `org.apache.hbase.thirdparty.org.apache.thrift`
+            references alone (we only match when not preceded by a dot).
+          -->
+          <plugin>
+            <groupId>com.google.code.maven-replacer-plugin</groupId>
+            <artifactId>replacer</artifactId>
+            <configuration>
+              <basedir>${basedir}/src/main/java</basedir>
+              <includes>
+                <include>org/apache/hadoop/hbase/thrift/generated/**/*.java</include>
+                <include>org/apache/hadoop/hbase/thrift2/generated/**/*.java</include>
+              </includes>
+              <ignoreErrors>false</ignoreErrors>
+              <replacements>
+                <replacement>
+                  <token>([^.])org\.apache\.thrift</token>
+                  <value>$1org.apache.hbase.thirdparty.org.apache.thrift</value>
+                </replacement>
+              </replacements>
+            </configuration>
+            <executions>
+              <execution>
+                <id>shade-generated-thrift-imports</id>
+                <goals>
+                  <goal>replace</goal>
+                </goals>
+                <phase>process-sources</phase>
+              </execution>
+            </executions>
+          </plugin>
         </plugins>
       </build>
     </profile>

hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/HThreadedSelectorServerArgs.java

@@ -19,12 +19,13 @@
 
 import java.util.Locale;
 import org.apache.hadoop.conf.Configuration;
-import org.apache.thrift.server.TThreadedSelectorServer;
-import org.apache.thrift.transport.TNonblockingServerTransport;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TThreadedSelectorServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TNonblockingServerTransport;
+
 /**
  * A TThreadedSelectorServer.Args that reads hadoop configuration
  */

hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ImplType.java

@@ -23,17 +23,17 @@
 import java.util.Arrays;
 import java.util.List;
 import org.apache.hadoop.conf.Configuration;
-import org.apache.thrift.server.THsHaServer;
-import org.apache.thrift.server.TNonblockingServer;
-import org.apache.thrift.server.TServer;
-import org.apache.thrift.server.TThreadedSelectorServer;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import org.apache.hbase.thirdparty.org.apache.commons.cli.CommandLine;
 import org.apache.hbase.thirdparty.org.apache.commons.cli.Option;
 import org.apache.hbase.thirdparty.org.apache.commons.cli.OptionGroup;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.THsHaServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TNonblockingServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TThreadedSelectorServer;
 
 /** An enum of server implementation selections */
 @InterfaceAudience.Private

hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/TBoundedThreadPoolServer.java

@@ -26,20 +26,20 @@
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.hbase.util.EnvironmentEdgeManager;
 import org.apache.hadoop.hbase.util.Threads;
-import org.apache.thrift.TException;
-import org.apache.thrift.TProcessor;
-import org.apache.thrift.protocol.TProtocol;
-import org.apache.thrift.server.TServer;
-import org.apache.thrift.server.TThreadPoolServer;
-import org.apache.thrift.transport.TServerTransport;
-import org.apache.thrift.transport.TSocket;
-import org.apache.thrift.transport.TTransport;
-import org.apache.thrift.transport.TTransportException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import org.apache.hbase.thirdparty.com.google.common.util.concurrent.ThreadFactoryBuilder;
+import org.apache.hbase.thirdparty.org.apache.thrift.TException;
+import org.apache.hbase.thirdparty.org.apache.thrift.TProcessor;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TThreadPoolServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TServerTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSocket;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TTransportException;
 
 /**
  * A bounded thread pool server customized for HBase.

hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftHBaseServiceHandler.java

@@ -85,14 +85,14 @@
 import org.apache.hadoop.hbase.thrift.generated.TScan;
 import org.apache.hadoop.hbase.thrift.generated.TThriftServerType;
 import org.apache.hadoop.hbase.util.Bytes;
-import org.apache.thrift.TException;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import org.apache.hbase.thirdparty.com.google.common.base.Throwables;
 import org.apache.hbase.thirdparty.com.google.common.cache.Cache;
 import org.apache.hbase.thirdparty.com.google.common.cache.CacheBuilder;
+import org.apache.hbase.thirdparty.org.apache.thrift.TException;
 
 /**
  * The HBaseServiceHandler is a glue object that connects Thrift RPC calls to the HBase client API

hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftHttpServlet.java

@@ -30,9 +30,6 @@
 import org.apache.hadoop.security.authorize.AuthorizationException;
 import org.apache.hadoop.security.authorize.ProxyUsers;
 import org.apache.http.HttpHeaders;
-import org.apache.thrift.TProcessor;
-import org.apache.thrift.protocol.TProtocolFactory;
-import org.apache.thrift.server.TServlet;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.ietf.jgss.GSSContext;
 import org.ietf.jgss.GSSCredential;
@@ -43,6 +40,10 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import org.apache.hbase.thirdparty.org.apache.thrift.TProcessor;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TProtocolFactory;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TServlet;
+
 /**
  * Thrift Http Servlet is used for performing Kerberos authentication if security is enabled and
  * also used for setting the user specified in "doAs" parameter.

hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServer.java

@@ -116,22 +116,6 @@
 import org.apache.hadoop.util.Shell.ExitCodeException;
 import org.apache.hadoop.util.Tool;
 import org.apache.hadoop.util.ToolRunner;
-import org.apache.thrift.TProcessor;
-import org.apache.thrift.protocol.TBinaryProtocol;
-import org.apache.thrift.protocol.TCompactProtocol;
-import org.apache.thrift.protocol.TProtocolFactory;
-import org.apache.thrift.server.THsHaServer;
-import org.apache.thrift.server.TNonblockingServer;
-import org.apache.thrift.server.TServer;
-import org.apache.thrift.server.TServlet;
-import org.apache.thrift.server.TThreadedSelectorServer;
-import org.apache.thrift.transport.TNonblockingServerSocket;
-import org.apache.thrift.transport.TNonblockingServerTransport;
-import org.apache.thrift.transport.TSaslServerTransport;
-import org.apache.thrift.transport.TServerSocket;
-import org.apache.thrift.transport.TServerTransport;
-import org.apache.thrift.transport.TTransportFactory;
-import org.apache.thrift.transport.layered.TFramedTransport;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -144,6 +128,22 @@
 import org.apache.hbase.thirdparty.org.apache.commons.cli.DefaultParser;
 import org.apache.hbase.thirdparty.org.apache.commons.cli.HelpFormatter;
 import org.apache.hbase.thirdparty.org.apache.commons.cli.Options;
+import org.apache.hbase.thirdparty.org.apache.thrift.TProcessor;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TBinaryProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TCompactProtocol;
+import org.apache.hbase.thirdparty.org.apache.thrift.protocol.TProtocolFactory;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.THsHaServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TNonblockingServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TServlet;
+import org.apache.hbase.thirdparty.org.apache.thrift.server.TThreadedSelectorServer;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TNonblockingServerSocket;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TNonblockingServerTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TSaslServerTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TServerSocket;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TServerTransport;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.TTransportFactory;
+import org.apache.hbase.thirdparty.org.apache.thrift.transport.layered.TFramedTransport;
 import org.apache.hbase.thirdparty.org.eclipse.jetty.ee8.servlet.ServletContextHandler;
 import org.apache.hbase.thirdparty.org.eclipse.jetty.ee8.servlet.ServletHolder;
 import org.apache.hbase.thirdparty.org.eclipse.jetty.http.HttpVersion;