From eba12f4ebf31290b71fccade2656f4b28b3c9261 Mon Sep 17 00:00:00 2001
From: Andy Wilkinson <andy.wilkinson@broadcom.com>
Date: Wed, 19 Feb 2025 15:35:33 +0000
Subject: [PATCH] Upgrade to Tomcat 10.1.36

Closes gh-44339
---
 gradle.properties                                    |  2 +-
 .../spring-boot-dependencies/build.gradle            |  4 ----
 .../tomcat/TomcatReactiveWebServerFactory.java       |  4 ++++
 .../tomcat/TomcatServletWebServerFactory.java        | 12 ++++++++----
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/gradle.properties b/gradle.properties
index c08b6bfcf54..68efefdc8c8 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -21,6 +21,6 @@ nativeBuildToolsVersion=0.10.5
 snakeYamlVersion=2.4
 springFrameworkVersion=6.2.3
 springFramework60xVersion=6.0.23
-tomcatVersion=10.1.34
+tomcatVersion=10.1.36
 
 kotlin.stdlib.default.dependency=false
diff --git a/spring-boot-project/spring-boot-dependencies/build.gradle b/spring-boot-project/spring-boot-dependencies/build.gradle
index 8689fb89035..c63344505e8 100644
--- a/spring-boot-project/spring-boot-dependencies/build.gradle
+++ b/spring-boot-project/spring-boot-dependencies/build.gradle
@@ -2544,10 +2544,6 @@ bom {
 			versionRange "[11.0.0-M1,)"
 			because "it exceeds our Jakarte EE 10 baseline"
 		}
-		prohibit {
-			versionRange "[10.1.35,10.1.36]"
-			because "https://bz.apache.org/bugzilla/show_bug.cgi?id=69576 and related problems in 10.1.36"
-		}
 		group("org.apache.tomcat") {
 			modules = [
 				"tomcat-annotations-api",
diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatReactiveWebServerFactory.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatReactiveWebServerFactory.java
index 5104bb4665c..e8e36c191a8 100644
--- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatReactiveWebServerFactory.java
+++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatReactiveWebServerFactory.java
@@ -36,6 +36,7 @@ import org.apache.catalina.connector.Connector;
 import org.apache.catalina.core.AprLifecycleListener;
 import org.apache.catalina.loader.WebappLoader;
 import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.webresources.StandardRoot;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.coyote.AbstractProtocol;
@@ -165,6 +166,9 @@ public class TomcatReactiveWebServerFactory extends AbstractReactiveWebServerFac
 	protected void prepareContext(Host host, TomcatHttpHandlerAdapter servlet) {
 		File docBase = createTempDir("tomcat-docbase");
 		TomcatEmbeddedContext context = new TomcatEmbeddedContext();
+		StandardRoot resourcesRoot = new StandardRoot();
+		resourcesRoot.setReadOnly(true);
+		context.setResources(resourcesRoot);
 		context.setPath("");
 		context.setDocBase(docBase.getAbsolutePath());
 		context.addLifecycleListener(new Tomcat.FixContextListener());
diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java
index c2d54cfaacf..c1887dc380a 100644
--- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java
+++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java
@@ -238,9 +238,10 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto
 	protected void prepareContext(Host host, ServletContextInitializer[] initializers) {
 		File documentRoot = getValidDocumentRoot();
 		TomcatEmbeddedContext context = new TomcatEmbeddedContext();
-		if (documentRoot != null) {
-			context.setResources(new LoaderHidingResourceRoot(context));
-		}
+		WebResourceRoot resourceRoot = (documentRoot != null) ? new LoaderHidingResourceRoot(context)
+				: new StandardRoot(context);
+		resourceRoot.setReadOnly(true);
+		context.setResources(resourceRoot);
 		context.setName(getContextPath());
 		context.setDisplayName(getDisplayName());
 		context.setPath(getContextPath());
@@ -814,7 +815,7 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto
 
 		@Override
 		public void lifecycleEvent(LifecycleEvent event) {
-			if (event.getType().equals(Lifecycle.CONFIGURE_START_EVENT)) {
+			if (event.getType().equals(Lifecycle.BEFORE_INIT_EVENT)) {
 				addResourceJars(getUrlsOfJarsWithMetaInfResources());
 			}
 		}
@@ -834,6 +835,9 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto
 					addResourceSet(url.toString());
 				}
 			}
+			for (WebResourceSet resources : this.context.getResources().getJarResources()) {
+				resources.setReadOnly(true);
+			}
 		}
 
 		private void addResourceSet(String resource) {