springboot项目漏洞“远端WWW服务支持TRACE请求”解决

最新推荐文章于 2025-10-17 09:41:17 发布

原创最新推荐文章于 2025-10-17 09:41:17 发布 · 3.7k 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#spring boot #java #服务器

服务器专栏收录该内容

1 篇文章

订阅专栏

该文展示了在低版本和高版本Springboot中如何配置Undertow，包括设置URL字符编码、Cookie值以及允许的HTTP方法，并添加安全约束。主要区别在于使用不同的容器工厂类和定制器接口。

项目中增加config类

低版本Springboot：

import io.undertow.UndertowOptions;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;
import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;

@Configuration
public class UndertowConfig {
    @Bean
    public EmbeddedServletContainerFactory embeddedServletContainerFactory() {
        UndertowEmbeddedServletContainerFactory factory = new UndertowEmbeddedServletContainerFactory();
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
        factory.addDeploymentInfoCustomizers(deploymentInfo -> {
            WebResourceCollection webResourceCollection = new WebResourceCollection();
            webResourceCollection.addUrlPattern("/*");
            webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
            webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
            webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
            webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());

            SecurityConstraint constraint = new SecurityConstraint();
            constraint.addWebResourceCollection(webResourceCollection);

            deploymentInfo.addSecurityConstraint(constraint);
        });
        return factory;
    }
}

高版本Springboot:

import io.undertow.UndertowOptions;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;

/**
 * @author zhanglei
 */
@Configuration
public class UndertowConfig implements WebServerFactoryCustomizer<UndertowServletWebServerFactory> {
    @Override
    public void customize(UndertowServletWebServerFactory factory) {
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
        factory.addDeploymentInfoCustomizers(deploymentInfo -> {
            WebResourceCollection webResourceCollection = new WebResourceCollection();
            webResourceCollection.addUrlPattern("/*");
            webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
            webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
            webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
            webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());

            SecurityConstraint constraint = new SecurityConstraint();
            constraint.addWebResourceCollection(webResourceCollection);

            deploymentInfo.addSecurityConstraint(constraint);
        });
    }
}