springboot项目漏洞“远端WWW服务支持TRACE请求”解决

项目中增加config类

1. 低版本Springboot：

import io.undertow.UndertowOptions;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;
import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;

@Configuration
public class UndertowConfig {
    @Bean
    public EmbeddedServletContainerFactory embeddedServletContainerFactory() {
        UndertowEmbeddedServletContainerFactory factory = new UndertowEmbeddedServletContainerFactory();
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
        factory.addDeploymentInfoCustomizers(deploymentInfo -> {
            WebResourceCollection webResourceCollection = new WebResourceCollection();
            webResourceCollection.addUrlPattern("/*");
            webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
            webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
            webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
            webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());

            SecurityConstraint constraint = new SecurityConstraint();
            constraint.addWebResourceCollection(webResourceCollection);

            deploymentInfo.addSecurityConstraint(constraint);
        });
        return factory;
    }
}

2. 高版本Springboot:

import io.undertow.UndertowOptions;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;

/**
 * @author zhanglei
 */
@Configuration
public class UndertowConfig implements WebServerFactoryCustomizer {
    @Override
    public void customize(UndertowServletWebServerFactory factory) {
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
        factory.addDeploymentInfoCustomizers(deploymentInfo -> {
            WebResourceCollection webResourceCollection = new WebResourceCollection();
            webResourceCollection.addUrlPattern("/*");
            webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
            webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
            webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
            webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());

            SecurityConstraint constraint = new SecurityConstraint();
            constraint.addWebResourceCollection(webResourceCollection);

            deploymentInfo.addSecurityConstraint(constraint);
        });
    }
}