I'm developing a web service that uses SpringBoot and uses the built-in Tomcat.
Also, since SSI (Server Side Include) is used, SSIServlet is used.
TL;DR
In Tomcat 9.0.30, SSI related modules are made into an external library, so The following Tomcat SSI library also had to be added to the dependency.
https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-ssi
JVNVU # 98104709 Update for multiple vulnerabilities in Apache Tomcat http://jvn.jp/vu/JVNVU98104709/index.html Therefore, it became necessary to upgrade the built-in Tomcat of Spring Boot.
So I decided to update the Spring Boot version to the latest release version 2.2.4.RELEASE.
https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#dependency-versions
According to the official documentation, the built-in Tomcat version is 9.0.30.
Now, if you look at the Tomcat 9.0.30 ChangeLog (https://tomcat.apache.org/tomcat-9.0-doc/changelog.html),
Moved server-side include (SSI) module into a separate JAR library. (schultz)
It has been described as.
If you actually change the Spring Boot version to 2.2.4.RELEASE in the build.gradle file,
The SSIServlet cannot be found and cannot be built.
I didn't say where I moved, so I searched the MVN Repository.
https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-ssi
I found the Tomcat SSI library in the MVN Repository.
I selected 9.0.30 according to the version of Spring Boot's built-in Tomcat and added it to dependencies of build.gradle, and now I can find SSIServlet without any problem and the build passes. It was.
In this article, I introduced the dependent libraries for using SSI in Tomcat 9.0.30 with built-in Spring Boot 2.2.4.RELEASE.
We look forward to helping you.
Recommended Posts