From 014a778651c29168f4d4886faf332191f14ce7bb Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:36:32 +0000
Subject: [PATCH] bug: bump embedded Tomcat to 9.0.116 for CVE-2026-29145

---
 UserFront/pom.xml                             |  1 +
 .../com/userFront/config/TomcatConfig.java    | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 UserFront/src/main/java/com/userFront/config/TomcatConfig.java

diff --git a/UserFront/pom.xml b/UserFront/pom.xml
index 902ec2b3..d39b8e8f 100644
--- a/UserFront/pom.xml
+++ b/UserFront/pom.xml
@@ -22,6 +22,7 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>1.8</java.version>
+		<tomcat.version>9.0.116</tomcat.version>
 	</properties>
 
 	<dependencies>
diff --git a/UserFront/src/main/java/com/userFront/config/TomcatConfig.java b/UserFront/src/main/java/com/userFront/config/TomcatConfig.java
new file mode 100644
index 00000000..3fed679d
--- /dev/null
+++ b/UserFront/src/main/java/com/userFront/config/TomcatConfig.java
@@ -0,0 +1,22 @@
+package com.userFront.config;
+
+import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer;
+import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer;
+import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * Spring Boot 1.5 registers Tomcat's default servlet through
+ * Context.addServletMapping(String, String), which no longer exists in Tomcat 9.
+ * Static resources are served by Spring MVC, so the default servlet is not needed.
+ */
+@Configuration
+public class TomcatConfig implements EmbeddedServletContainerCustomizer {
+
+    @Override
+    public void customize(ConfigurableEmbeddedServletContainer container) {
+        if (container instanceof TomcatEmbeddedServletContainerFactory) {
+            ((TomcatEmbeddedServletContainerFactory) container).setRegisterDefaultServlet(false);
+        }
+    }
+}