springboot项目漏洞“远端WWW服务支持TRACE请求”解决

心已赠人 2024-03-27 12:40 55阅读 0赞

项目中增加config类

1.  低版本Springboot：

import io.undertow.UndertowOptions;
    import io.undertow.servlet.api.SecurityConstraint;
    import io.undertow.servlet.api.WebResourceCollection;
    import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;
    import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpMethod;
    
    @Configuration
    public class UndertowConfig {
        @Bean
        public EmbeddedServletContainerFactory embeddedServletContainerFactory() {
            UndertowEmbeddedServletContainerFactory factory = new UndertowEmbeddedServletContainerFactory();
            factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
            factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
            factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
            factory.addDeploymentInfoCustomizers(deploymentInfo -> {
                WebResourceCollection webResourceCollection = new WebResourceCollection();
                webResourceCollection.addUrlPattern("/*");
                webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
                webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
                webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
                webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
                webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
                webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());
    
                SecurityConstraint constraint = new SecurityConstraint();
                constraint.addWebResourceCollection(webResourceCollection);
    
                deploymentInfo.addSecurityConstraint(constraint);
            });
            return factory;
        }
    }

1.  高版本Springboot:

import io.undertow.UndertowOptions;
    import io.undertow.servlet.api.SecurityConstraint;
    import io.undertow.servlet.api.WebResourceCollection;
    import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
    import org.springframework.boot.web.server.WebServerFactoryCustomizer;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpMethod;
    
    /**
     * @author zhanglei
     */
    @Configuration
    public class UndertowConfig implements WebServerFactoryCustomizer<UndertowServletWebServerFactory> {
        @Override
        public void customize(UndertowServletWebServerFactory factory) {
            factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
            factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
            factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
            factory.addDeploymentInfoCustomizers(deploymentInfo -> {
                WebResourceCollection webResourceCollection = new WebResourceCollection();
                webResourceCollection.addUrlPattern("/*");
                webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
                webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
                webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
                webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
                webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
                webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());
    
                SecurityConstraint constraint = new SecurityConstraint();
                constraint.addWebResourceCollection(webResourceCollection);
    
                deploymentInfo.addSecurityConstraint(constraint);
            });
        }
    }