Upgrade to Tomcat 10.1.36

Closes gh-44331

Author: wilkinsona

gradle.properties

@@ -21,6 +21,6 @@ nativeBuildToolsVersion=0.10.5
 snakeYamlVersion=2.2
 springFrameworkVersion=6.1.17
 springFramework60xVersion=6.0.23
-tomcatVersion=10.1.34
+tomcatVersion=10.1.36
 
 kotlin.stdlib.default.dependency=false

spring-boot-project/spring-boot-dependencies/build.gradle

@@ -2433,10 +2433,6 @@ bom {
 		}
 	}
 	library("Tomcat", "${tomcatVersion}") {
-		prohibit {
-			versionRange "[10.1.35,10.1.36]"
-			because "https://bz.apache.org/bugzilla/show_bug.cgi?id=69576 and related problems in 10.1.36"
-		}
 		group("org.apache.tomcat") {
 			modules = [
 				"tomcat-annotations-api",

spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatReactiveWebServerFactory.java

@@ -36,6 +36,7 @@
 import org.apache.catalina.core.AprLifecycleListener;
 import org.apache.catalina.loader.WebappLoader;
 import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.webresources.StandardRoot;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.coyote.AbstractProtocol;
@@ -165,6 +166,9 @@ private void configureEngine(Engine engine) {
 	protected void prepareContext(Host host, TomcatHttpHandlerAdapter servlet) {
 		File docBase = createTempDir("tomcat-docbase");
 		TomcatEmbeddedContext context = new TomcatEmbeddedContext();
+		StandardRoot resourcesRoot = new StandardRoot();
+		resourcesRoot.setReadOnly(true);
+		context.setResources(resourcesRoot);
 		context.setPath("");
 		context.setDocBase(docBase.getAbsolutePath());
 		context.addLifecycleListener(new Tomcat.FixContextListener());

spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java

@@ -238,9 +238,10 @@ private void configureEngine(Engine engine) {
 	protected void prepareContext(Host host, ServletContextInitializer[] initializers) {
 		File documentRoot = getValidDocumentRoot();
 		TomcatEmbeddedContext context = new TomcatEmbeddedContext();
-		if (documentRoot != null) {
-			context.setResources(new LoaderHidingResourceRoot(context));
-		}
+		WebResourceRoot resourceRoot = (documentRoot != null) ? new LoaderHidingResourceRoot(context)
+				: new StandardRoot(context);
+		resourceRoot.setReadOnly(true);
+		context.setResources(resourceRoot);
 		context.setName(getContextPath());
 		context.setDisplayName(getDisplayName());
 		context.setPath(getContextPath());
@@ -814,7 +815,7 @@ private StaticResourceConfigurer(Context context) {
 
 		@Override
 		public void lifecycleEvent(LifecycleEvent event) {
-			if (event.getType().equals(Lifecycle.CONFIGURE_START_EVENT)) {
+			if (event.getType().equals(Lifecycle.BEFORE_INIT_EVENT)) {
 				addResourceJars(getUrlsOfJarsWithMetaInfResources());
 			}
 		}
@@ -834,6 +835,9 @@ private void addResourceJars(List<URL> resourceJarUrls) {
 					addResourceSet(url.toString());
 				}
 			}
+			for (WebResourceSet resources : this.context.getResources().getJarResources()) {
+				resources.setReadOnly(true);
+			}
 		}
 
 		private void addResourceSet(String resource) {