@Override
      public String getServerName() {
        return HtmlQuoting.quoteHtmlChars(rawRequest.getServerName());
      }
Quote the server name so that users specifying the HOST HTTP header
can't inject attacks.
common/src/java/org/apache/hive/http/HttpServer.java