From 930ea4665b563babd193e3e7ff1bc7548f76096b Mon Sep 17 00:00:00 2001
From: Jeet <jeet.kaushik@altair.com>
Date: Wed, 6 Apr 2022 18:53:12 +0530
Subject: [PATCH] Disabling tomcat Valve to prevent from Spring4Shell
 vunerability (CVE-2022-22965).

---
 Dockerfile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 086cd5e..8a5aff8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,5 +13,13 @@ RUN mvn clean package
 #  Deploy to tomcat
 RUN mv target/helloworld.war /usr/local/tomcat/webapps/
 
+# comment Value in server.xml
+#   <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+#       prefix="localhost_access_log" suffix=".txt"
+#       pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+
+RUN sed -i '163 i <!--' /usr/local/tomcat/conf/server.xml
+RUN sed -i '167 i -->' /usr/local/tomcat/conf/server.xml
+
 EXPOSE 8080
 CMD ["catalina.sh", "run"]