@Override
      public StringBuffer getRequestURL(){
        String url = rawRequest.getRequestURL().toString();
        return new StringBuffer(HtmlQuoting.quoteHtmlChars(url));
      }
Quote the url so that users specifying the HOST HTTP header
can't inject attacks.
common/src/java/org/apache/hive/http/HttpServer.java