I can not speak for Sun.
I am not a lawyer.
The Glassfish licenses (CDDL and GPL(Is GF mixed now?)) are the open source licenses.
If you license Suns Java Application Server, which is 99% GF, then you will likely be under a different license.
In the past, Sun has offered indemnification for Solaris (specifically addressing the SCO case), I don't know if they still do, just pointing out the precedent. Thus, they may well also offer the same for SJAS.
Now, on to other matters.
My understanding is GF is pretty much entirely source internally from Sun. i.e. they wrote it. Back in the day, it may well have been inspired or borrowed code from the original iPlanet offering, which Sun bought. I do not know if any of the original iPlanet code is still in GF or not. When they create SJAS 9/GF from the SJAS 8 code base, there were key parts that were not open sourced, and those parts were or are being rewritten (HADB being an example, but I believe there were others).
This implies that they've vetted the true source of the components of the application server and removed the questionable parts that were not appropriate for open source.
So, all I can do is offer up two points:
One, if this is a concern, you should talk to a Sun rep directly specifically about this issue, particularly with regards to running the Sun licensed version of Glassfish, vs the open source Glassfish downloaded from the web. Get your lawyers to talk to their lawyers and they can have lunch.
But, two, it seems to me, from anecdotes I've read and having been here for a while, that the pedigree of the source code is reasonably clear and 100% controlled by Sun.
There is a LOT of commit history in the source archive that should also give some insight as to where the code is coming from that may help reassure you.
[Message sent by forum member 'whartung' (whartung)]
http://forums.java.net/jive/thread.jspa?messageID=330424