[devin-ai-integration]

Summary

Fixes Snyk SNYK-JAVA-ORGSPRINGFRAMEWORK-3369749 / CVE-2023-20861 (SpEL DoS, CWE-770), finding sfind-6bdeef5c: UserFront/pom.xml pulled in spring-expression@4.3.9.RELEASE through spring-boot-starter-web@1.5.4.RELEASE.

This follows Snyk's upgrade path: parent spring-boot-starter-parent 1.5.4.RELEASE → 2.5.15, which brings spring-webmvc/spring-expression 5.3.27. The Spring 5.2.x fix (5.2.23) can't be used, because no Boot release ships it and Boot 1.5 can't run on Spring 5.

Major version bump (Boot 1.x → 2.x). <java.version>1.8</java.version> stays the same. I picked 2.5.15 over 2.6+/2.7 because 2.5 still allows the existing UserServiceImpl ↔ AccountServiceImpl circular dependency, and it still manages the mysql:mysql-connector-java coordinates. That avoids spring.main.allow-circular-references and a driver swap.

The Boot 2 changes needed to stay working:

• AppointmentServiceImpl.findAppointment: appointmentDao.findOne(id) → appointmentDao.findById(id).orElse(null) (Spring Data 2.x API).
• application.properties: spring.jpa.hibernate.use-new-id-generator-mappings = false. Without it, GenerationType.AUTO would switch from MySQL AUTO_INCREMENT to a hibernate_sequence table.
• UserFrontApplicationTests: JUnit 4 @RunWith(SpringRunner.class) → JUnit 5 @Test. Boot 2.4+ spring-boot-starter-test no longer includes the vintage engine.

Duplicate notice: open PR #173 (finding sfind-dbd6fe7e) fixes the same CVE with Boot 2.7.10. This PR exists only because a new ticket was filed. Land just one of them.

Verification

Maven Central and api.snyk.io are blocked in this session, and the 2.5.15 BOM isn't in the local cache. So I could not build on the exact 2.5.15 parent or run the Snyk rescan (snyk test → SNYK-CLI-0000). Instead I verified with the closest cached Boot 2.x/Spring 5.3 line:

• SpEL probe ('X' * 50000000, the CVE-2023-20861 repeat-operator case):
  • spring-expression 4.3.12: EVALUATED: length=50000000
  • 5.3.25: EVALUATED: length=50000000
  • 5.3.31: REJECTED: EL1076E: Repeated text is too long, exceeding the threshold of '256' characters
• UserFront on Boot 2.7.18 / Spring 5.3.31 (same diff; the harness alone adds allow-circular-references and a connector version): mvn -o test-compile OK. UserFrontApplicationTests.contextLoads against MySQL 5.7 passes (1 found / 1 successful). Booted the app and checked signup → login (302 /userFront) → /userFront 200 → deposit $250 (primary_account.account_balance = 250.00, transaction Finished).
• Snyk issue count for this finding: before 1 (spring-expression@4.3.9). After: expected 0 (5.3.27 ≥ fixed 5.3.26), but the scan couldn't run here. Please re-run Snyk in CI or locally to confirm.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/1ea1120bfc044cb3a79d94cb40bf5f9e
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/1ea1120bfc044cb3a79d94cb40bf5f9e?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)