Using SSIServlet with built-in Tomcat of SpringBoot 2.2.4

Target audience

I'm developing a web service that uses SpringBoot and uses the built-in Tomcat. Also, since SSI (Server Side Include) is used, SSIServlet is used.

TL;DR

In Tomcat 9.0.30, SSI related modules are made into an external library, so The following Tomcat SSI library also had to be added to the dependency.

https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-ssi

Background

JVNVU # 98104709 Update for multiple vulnerabilities in Apache Tomcat http://jvn.jp/vu/JVNVU98104709/index.html Therefore, it became necessary to upgrade the built-in Tomcat of Spring Boot.

So I decided to update the Spring Boot version to the latest release version 2.2.4.RELEASE.

SpringBoot 2.2.4 RELEASE built-in tomcat version

https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#dependency-versions

According to the official documentation, the built-in Tomcat version is 9.0.30.

In Tomcat 9.0.30, SSI related modules are made into an external library!

Now, if you look at the Tomcat 9.0.30 ChangeLog (https://tomcat.apache.org/tomcat-9.0-doc/changelog.html),

Moved server-side include (SSI) module into a separate JAR library. (schultz)

It has been described as.

If you actually change the Spring Boot version to 2.2.4.RELEASE in the build.gradle file, The SSIServlet cannot be found and cannot be built.

I didn't say where I moved, so I searched the MVN Repository.

It was split into the Tomcat SSI library

https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-ssi

I found the Tomcat SSI library in the MVN Repository.

I selected 9.0.30 according to the version of Spring Boot's built-in Tomcat and added it to dependencies of build.gradle, and now I can find SSIServlet without any problem and the build passes. It was.

Summary

In this article, I introduced the dependent libraries for using SSI in Tomcat 9.0.30 with built-in Spring Boot 2.2.4.RELEASE.

We look forward to helping you.