@Override
      public String getServerName() {
        return HtmlQuoting.quoteHtmlChars(rawRequest.getServerName());
      }
Quote the server name so that users specifying the HOST HTTP header can't inject attacks.
hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java