Rework main build POM to be an aggregator pom that does not inherit
from any parent. Introduce new spring-boot-dependencies module to
act as a parent for both spring-boot-starter-parent and
spring-boot-parent.
Update ConfigFileApplicationContextInitializer so that the names
property defaults to `${spring.config.name},application`. This allows
application.properties files to be loaded even when property placeholder
expansion is not enabled.
Issue: #54462910
Update Javadoc to indicate the sources are used in addition to those
specified on construction. Also renamed member variables and fixed
log output.
Issue: #54185750
Now the environment overrides aare **added** to the
sources provided in SpringApplication.run(). This
avoids some potential surprises where setSources()
would have been silently ignored.
[#54185750]
The problem this change fixes is that spring.main.sources would always
be bound to SpringApplication.sources when provided in a properties file
even if SpringApplication.run() is called directly with sources. This
led to confusion with users saying that their sources were not working
where in fact they weren't even being used.
There would be more than one way to approach this problem, but we
have chosen for now to ignore spring.main.sources completely
if the SpringApplication constructor was already called with
explicit non-empty sources. It might be preferable, if possible,
to only ignore its value in an external properties file (allowing
command line or System properties to override). If we want to change
the behaviour again, I suggest a new story should be created.
[Fixes#54185750] [bs-255]
* Added additional search in
AbstractEmbeddedServletContainerFactory.getValidDocumentRoot() to
detect a /WEB-INF/ directory in the code archive
* If the code archive is in /WEB-INF/** then we assume it is
safe to serve content from / (exposes the loader classes
but nothing sensitive from the app)
[Fixes#54345578]
Phillip Webb
Dave Syer