Excluding servlet-related dependencies (#1912)

[pmauduit]

These jars should be provided by the servlet container.

Note: If Hadoop transitively requires jetty + jetty:jsp-api + servlet-api (in wfsfeature-harvester subproject), there is probably a good reason for this. I preferred to exclude the dependencies from the web/pom.xml instead of acting on each maven subprojects.

Note 2: some classes actually require the servlet-api jar, so I added it as a dependency, but keeping it away from the resulting artifact using the 'provided' scope.

Tests: compilation + runtime on web, no issue so far.

[Delawen]

Makes sense to remove dependencies that may break some containers.

[josegar74]

@pmauduit would you mind to upgrade the PR for master branch?

Apologies about the late response.

[pmauduit]

Apologies about the late response.

No worries, done ;-)

[juanluisrp]

Looking for javax.servlet.Servlet.class inside WEB-INF/lib/*.jar files and I can't find any occurrence, so it is not included anymore in the libraries distributed in the WAR.
Tested in Tomcat 9.0.8.0 and no warning about Servlet API is thrown.

[juanluisrp]

Backported to 3.4.x branch.

[etj]

@juanluisrp wouldnt it be enough to set the javax.servlet.api as <scope>provided</scope>? It will not include the jar in the war file, nor it will be transitive, so it wouldnt need to be excluded.

Here an excerpt from the doc:

provided

This is much like compile, but indicates you expect the JDK or a container to provide the dependency > at runtime. For example, when building a web application for the Java Enterprise Edition, you would
set the dependency on the Servlet API and related Java EE APIs to scope provided because the web
container provides those classes. This scope is only available on the compilation and test classpath,
and is not transitive.

[juanluisrp]

I've checked it in a commit previous to this PR and adding

    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.mortbay.jetty</groupId>
      <artifactId>servlet-api</artifactId>
      <version>2.5-20081211</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.mortbay.jetty</groupId>
      <artifactId>servlet-api-2.5</artifactId>
      <version>6.1.14</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.mortbay.jetty</groupId>
      <artifactId>jsp-api-2.1</artifactId>
      <version>6.1.14</version>
      <scope>provided</scope>
    </dependency>

to web/pom.xml makes no servlet-api*.jar and jsp-api-2.1.jar be present in WEB-INF/lib.

I don't know which is the best approach, include as provided or use excludes.

[pmauduit]

In the pom snippet above, you seem to "exclude" a specific version of the unwanted jars ; the "exclude" approach makes sure that the dependency won't be included in the WAR regardless of the version. But feel free to adapt if you prefer using the provided scope, I have no objection on it.