[devin-ai-integration]

Summary

Code scan finding sfind-46850d6b (Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-19267072, CVE-2026-59282, CWE-770): spring-beans@4.3.9.RELEASE (via Boot 1.5.4 spring-boot-starter-web). Data binding a crafted property path with a huge index can grow a self-populating list until memory runs out.

This is a mitigation, not the version bump. Please read this first. The only fixed version is Spring 7.0.9. That needs Boot 4 and Java 17+, and the remediation guidance says "Do not change the Java version" (UserFront stays on java.version 1.8). Spring 7 also isn't available offline in this environment. So this PR blocks the attack path in UserFront instead:

@ControllerAdvice
public class DataBindingConfig {
    public static final String[] DISALLOWED_FIELD_PATTERNS = {"*[*", "*]*"};
    @InitBinder
    public void rejectIndexedPropertyPaths(WebDataBinder binder) {
        binder.setDisallowedFields(DISALLOWED_FIELD_PATTERNS);
    }
}

Every @ModelAttribute binder now drops request parameters such as items[100000000].name and items['1'].x before they reach BeanWrapper. They show up in BindingResult.getSuppressedFields(). No UserFront template posts indexed field names (checked with grep for th:field/name containing [), and @ModelAttribute targets (User, Recipient, Appointment) only bind scalar fields. Existing forms should behave the same.

Duplicate: this is the same change as open PR #155 (sfind-8942cfd6, same CVE). It's a separate PR because of the one-ticket-one-PR rule. Merge only one of them. The real upgrade is the Boot 4.1.1 / Java 21 migration in #100 / #111–#116.

Verification

• DataBindingConfigTest (JUnit 4, new): the unhardened binder grows an AutoPopulatingList to 5001 entries (shows the vulnerable behaviour). With the hardened binder, list-index and map-key paths are suppressed and the list stays empty, while plain fields still bind. I compiled it with javac --release 8 and ran it with JUnitCore against cached spring 4.3.12 and 4.3.30 jars: OK (4 tests) on both.
• Not verified: a full mvn test and a Snyk re-scan. The Boot 1.5.4 parent isn't in the local Maven cache, and Maven Central and api.snyk.io are blocked by this session's network policy (snyk test → SNYK-CLI-0000).
• Snyk issue count, before/after: 1 → 1 (estimated, not measured). The dependency version doesn't change, so Snyk will still report this issue until the Spring 7.0.9 upgrade lands.

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/28cba4a8fd7e47b6b9cddff60cae5985
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/28cba4a8fd7e47b6b9cddff60cae5985?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)