From 6fb0328bc88721ebe451dee8db8aaa4db96467b3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 29 Jun 2026 13:38:10 +0000
Subject: [PATCH 1/2] Initial plan


From 8de82aa8bc2fcf8e5a9fd6883d3370563a5d203a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 29 Jun 2026 13:42:41 +0000
Subject: [PATCH 2/2] fix: upgrade tomcat and harden partial put handling

---
 build.gradle.kts                              |  2 ++
 .../org/example/TomcatSecurityConfig.java     | 25 +++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 src/main/java/org/example/TomcatSecurityConfig.java

diff --git a/build.gradle.kts b/build.gradle.kts
index 7a6895d..58abc91 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -10,6 +10,8 @@ plugins {
 group = "org.example"
 version = "1.0-SNAPSHOT"
 
+extra["tomcat.version"] = "9.0.99"
+
 repositories {
     mavenCentral()
 }
diff --git a/src/main/java/org/example/TomcatSecurityConfig.java b/src/main/java/org/example/TomcatSecurityConfig.java
new file mode 100644
index 0000000..ca06fb1
--- /dev/null
+++ b/src/main/java/org/example/TomcatSecurityConfig.java
@@ -0,0 +1,25 @@
+package org.example;
+
+import org.apache.catalina.Container;
+import org.apache.catalina.Wrapper;
+import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
+import org.springframework.boot.web.server.WebServerFactoryCustomizer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class TomcatSecurityConfig {
+
+    @Bean
+    public WebServerFactoryCustomizer<TomcatServletWebServerFactory> tomcatHardeningCustomizer() {
+        return factory -> {
+            factory.addConnectorCustomizers(connector -> connector.setProperty("allowPartialPut", "false"));
+            factory.addContextCustomizers(context -> {
+                Container defaultServlet = context.findChild("default");
+                if (defaultServlet instanceof Wrapper) {
+                    ((Wrapper) defaultServlet).addInitParameter("readonly", "true");
+                }
+            });
+        };
+    }
+}