@Override
      public StringBuffer getRequestURL() {
        String url = rawRequest.getRequestURL().toString();
        return new StringBuffer(HtmlQuoting.quoteHtmlChars(url));
      }
Quote the url so that users specifying the HOST HTTP header can't inject attacks.
hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java