[devin-ai-integration]

Summary

Fixes code scan finding sfind-3dee16a2 (Snyk SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-2438287 / CVE-2022-27772, high, CVSS 7.8). In Boot 1.5.4 the embedded-server temp directory (AbstractConfigurableWebServerFactory.createTempDir) is created world-readable, so it can be hijacked. The finding points at UserFront/pom.xml:30 (spring-boot-starter-web).

This is a major version bump. 2.2.11.RELEASE is the smallest version that fixes it ([,2.2.11.RELEASE) is vulnerable), and no 1.5.x release has the fix. Java stays at 1.8.

 UserFront/pom.xml
-  <version>1.5.4.RELEASE</version>   <!-- spring-boot-starter-parent -->
+  <version>2.2.11.RELEASE</version>
 AppointmentServiceImpl.findAppointment
-  return appointmentDao.findOne(id);                 // removed in Spring Data 2.x
+  return appointmentDao.findById(id).orElse(null);   // same null-on-missing behaviour
 application.properties
+  spring.jpa.hibernate.use-new-id-generator-mappings = false   // keep MySQL AUTO_INCREMENT ids (Boot 2 would otherwise switch GenerationType.AUTO to hibernate_sequence)

Nothing else needed changing. The rest of the code builds as-is on Boot 2.2: BCryptPasswordEncoder is set explicitly, and Boot 2.2 still allows the app's circular UserServiceImpl/AccountServiceImpl beans (Boot 2.6+ rejects them). The BOM still manages mysql:mysql-connector-java, which becomes 8.0.x.

Verification

The session runs with only git access, so Maven Central and api.snyk.io couldn't be reached. Because of that:

• Snyk before/after counts aren't available. snyk test fails with SNYK-CLI-0000 (network). The expected result is that this issue disappears after the change; please re-run the scan to confirm.
• The 2.2.11 artifacts aren't in the local cache, so I verified on a copy of this branch that uses the cached 2.2.6.RELEASE parent instead. That copy has the same Spring 5.2 / Spring Data Moore / Hibernate 5.4 / Tomcat 9 line. The thymeleaf and security starters weren't cached, so I swapped them for their component jars. Results:
  • mvn -o compile / test-compile (JDK 17, java.version 1.8): OK
  • Existing UserFrontApplicationTests.contextLoads run via JUnitCore against mysql:5.7: OK (1 test)
  • App boot and curl smoke test against MySQL: signup 302 -> /, login (POST /index) 302 -> /userFront, deposit 250 shown on /account/primaryAccount and stored in primary_account, admin /api/appointment/all 200, and /api/appointment/{id}/confirm (the findById path) sets confirmed=1
  • A missing appointment id still NPEs in confirmAppointment, the same as findOne returning null on master

Duplicates

Open PR #212 (finding sfind-b2e00155) makes the same change for the same CVE. Only one of the two should land. Open Boot 2.7/3.x migration PRs (e.g. #173, #229, #71) also clear this CVE.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/13c4db28fbec487d8093d3a17a287295
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/13c4db28fbec487d8093d3a17a287295?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

🔍 Devin Review: 2 flags

Not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)