HADOOP-12584. Disable browsing the static directory in HttpServer2. Contributed by Robert Kanter.

hadoop-common-project/hadoop-common/CHANGES.txt

@@ -808,6 +808,9 @@ Release 2.8.0 - UNRELEASED
     HADOOP-11901. BytesWritable fails to support 2G chunks due to integer
     overflow. (Reynold Xin via wheat9)
 
+    HADOOP-12584. Disable browsing the static directory in HttpServer2.
+    (Robert Kanter via wheat9)
+
 Release 2.7.3 - UNRELEASED
 
   INCOMPATIBLE CHANGES

hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java

@@ -562,6 +562,9 @@ public final class HttpServer2 implements FilterContainer {
     staticContext.setResourceBase(appDir + "/static");
     staticContext.addServlet(DefaultServlet.class, "/*");
     staticContext.setDisplayName("static");
+    @SuppressWarnings("unchecked")
+    Map<String, String> params = staticContext.getInitParams();
+    params.put("org.mortbay.jetty.servlet.Default.dirAllowed", "false");
     setContextAttributes(staticContext, conf);
     defaultContexts.put(staticContext, true);
   }