[devin-ai-integration]

Summary

Fixes code-scan finding sfind-d7d37c89 — CVE-2024-38821 (SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8309135, CWE-862, critical), spring-security-web authorization bypass for static resources. It comes in through spring-boot-starter-security in UserFront/pom.xml.

Spring Boot 1.5.4 pins Spring Security 4.2.3, and the 4.x line has no fix. The fixed releases are 5.7.13 / 5.8.15 / 6.2.7 / 6.3.4. This PR uses the smallest one that runs on Java 8: 5.7.13, on the last Java 8 Boot line.

- spring-boot-starter-parent 1.5.4.RELEASE
+ spring-boot-starter-parent 2.7.18          # ships security 5.7.11, which is still affected
+ <spring-security.version>5.7.13</spring-security.version>
- mysql:mysql-connector-java  ->  + com.mysql:mysql-connector-j   (2.7.x BOM manages only the new coordinates)

<java.version>1.8</java.version> stays the same.

Major bump (flagged): Boot 1.5 -> 2.7 is a major upgrade. No 1.5.x or 2.x Boot line ships a fixed Security version without it. Snyk's suggested path (Boot 3.2.11 / Security 6.2.7) would need Java 17, which the remediation guidance rules out.

Code changes required by Boot 2.x:

• SecurityConfig: the @Autowired configureGlobal(AuthenticationManagerBuilder) became an @Override configure(AuthenticationManagerBuilder).
• AppointmentServiceImpl.findAppointment: findOne(id) became findById(id).orElse(null) (Spring Data 2.x).
• application.properties: added spring.main.allow-circular-references=true. Without it the existing UserServiceImpl <-> AccountServiceImpl bean cycle fails to start on Boot 2.6+.
• UserFrontApplicationTests moved from JUnit 4 to JUnit 5. Boot 2.7's spring-boot-starter-test has no vintage engine.

Per the scan's own note, the CVE is only exploitable in WebFlux apps. UserFront is servlet/MVC, so its real exposure is low, but the vulnerable artifact is now off the classpath.

Verification

Maven Central isn't reachable from the build VM and 5.7.13 isn't cached. All runs therefore used the cached 5.7.11 jars (-Dspring-security.version=5.7.11). 5.7.11 to 5.7.13 is a patch-only change on the same branch, with the same API.

• mvn -o -Dspring-security.version=5.7.11 -DskipTests package (JDK 17, --release 8) succeeded.
• UserFrontApplicationTests.contextLoads ran through the JUnit Platform launcher (surefire's junit-platform provider isn't cached) against mysql:5.7: 1/1 passed.
• Booted the jar against mysql:5.7 and ran the curl flow:
  • anonymous /userFront returns 302 to /index
  • signup returns 302
  • login (POST /index) returns 302 to /userFront, and /userFront then returns 200
  • a bad password returns 302 to /index?error
  • a deposit of 100 returns 302, and the DB shows primary_account.account_balance=100.00
  • /css/main.css returns 200
• Snyk re-scan not run: snyk test fails because api.snyk.io is blocked by the session network policy, so there is no before/after issue count. Before: this finding (1 critical, CVE-2024-38821). After (expected): resolved, since spring-security-web resolves to 5.7.13, which is outside every vulnerable range. Network access has been requested.

Duplicates

Branch devin/1790739499-spring-security-cve-2024-38821 (earlier run) does the same migration but pins 5.8.16. Open PRs #184 / #227 also move to Boot 2.7.18 (5.7.11 / 5.7.14); #227's 5.7.14 also clears this CVE. Only one of these should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/6455c9185a8841e08ffe2f7440434503
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/6455c9185a8841e08ffe2f7440434503?variant=devin

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring