YARN: restrict web proxy redirects to the application host

[nishat-06]

Description of PR

WebAppProxyServlet.proxyLink fetches an application's tracking URL server-side with an HttpClient that auto-follows redirects, and that tracking URL is whatever the application master registered. A malicious AM can answer the proxied request with a redirect to http://169.254.169.254/ (cloud metadata), a loopback admin port, or another internal cluster service, and the proxy follows it and streams the response back to the viewing user, which is a server-side request forgery. This restricts the follow to the application's own host: a SameHostRedirectStrategy rejects any redirect whose host differs from the tracking URL host, so a same-host application UI redirect still works while a cross-host hop is refused.

Trigger before the change: AM registers a tracking URL, the proxied GET returns 302 Location: http://169.254.169.254/latest/meta-data/, and the proxy fetches the metadata endpoint from inside the cluster and returns the body. After the change that redirect is not followed and the fetch fails like any other unreachable target.

How was this patch tested?

Added testProxyRedirectToDifferentHostIsRefused which drives the strategy with a same-host Location (followed) and a 169.254.169.254 Location (refused with ProtocolException), and ran the hadoop-yarn-server-web-proxy module tests. The testAppReportForEmptyTrackingUrl failure seen locally is unrelated and reproduces on a clean tree (this host has no resolvable hostname).

For code changes:

• Does the title of this PR start with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
• Object storage: Have the integration tests been executed and the endpoint
  declared according to the connector-specific documentation? Note: Automated CI
  testing doesn't cover all cases so manual testing with cloud storage is still
  required.
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

AI Tooling

If an AI tool was used:

• The PR includes the phrase "Contains content generated by "
  where is the name of the AI tool used.
• My use of AI contributions follows the ASF legal policy
  https://www.apache.org/legal/generative-tooling.html

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	6m 37s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
+1 💚	test4tests	0m 0s		The patch appears to include 1 new or modified test files.
			_ trunk Compile Tests _
+1 💚	mvninstall	27m 57s		trunk passed
+1 💚	compile	0m 33s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	compile	0m 32s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	checkstyle	0m 34s		trunk passed
+1 💚	mvnsite	0m 34s		trunk passed
+1 💚	javadoc	0m 34s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	0m 34s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	spotbugs	0m 46s		trunk passed
+1 💚	shadedclient	16m 7s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	0m 14s		the patch passed
+1 💚	compile	0m 13s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javac	0m 13s		the patch passed
+1 💚	compile	0m 13s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	javac	0m 13s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	0m 11s		the patch passed
+1 💚	mvnsite	0m 17s		the patch passed
+1 💚	javadoc	0m 14s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	0m 14s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	spotbugs	0m 34s		the patch passed
+1 💚	shadedclient	15m 17s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	1m 1s		hadoop-yarn-server-web-proxy in the patch passed.
-1 ❌	asflicense	0m 25s	/results-asflicense.txt	The patch generated 1 ASF License warnings.
		75m 30s

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8701/1/artifact/out/Dockerfile
GITHUB PR	#8701
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux 5d4745bf3bb9 5.15.0-190-generic #200-Ubuntu SMP Fri Aug 7 15:06:04 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 32e980d
Default Java	Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.11+10-1-24.04.2-Ubuntu /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8701/1/testReport/
Max. process+thread count	612 (vs. ulimit of 10000)
modules	C: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy U: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8701/1/console
versions	git=2.43.0 maven=3.9.15 spotbugs=4.9.7
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.