springboot项目漏洞“远端WWW服务支持TRACE请求”解决

最新推荐文章于 2023-09-26 10:04:19 发布

aflyXu

最新推荐文章于 2023-09-26 10:04:19 发布

阅读量2.3k

点赞数

分类专栏：服务器文章标签： spring boot java 服务器 Powered by 金山文档

本文链接：https://blog.csdn.net/coder_afly/article/details/128871353

版权

服务器专栏收录该内容

1 篇文章 0 订阅

订阅专栏

项目中增加config类

低版本Springboot：

import io.undertow.UndertowOptions;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;
import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;

@Configuration
public class UndertowConfig {
    @Bean
    public EmbeddedServletContainerFactory embeddedServletContainerFactory() {
        UndertowEmbeddedServletContainerFactory factory = new UndertowEmbeddedServletContainerFactory();
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
        factory.addDeploymentInfoCustomizers(deploymentInfo -> {
            WebResourceCollection webResourceCollection = new WebResourceCollection();
            webResourceCollection.addUrlPattern("/*");
            webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
            webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
            webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
            webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());

            SecurityConstraint constraint = new SecurityConstraint();
            constraint.addWebResourceCollection(webResourceCollection);

            deploymentInfo.addSecurityConstraint(constraint);
        });
        return factory;
    }
}

高版本Springboot:

import io.undertow.UndertowOptions;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;

/**
 * @author zhanglei
 */
@Configuration
public class UndertowConfig implements WebServerFactoryCustomizer<UndertowServletWebServerFactory> {
    @Override
    public void customize(UndertowServletWebServerFactory factory) {
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, Boolean.TRUE));
        factory.addBuilderCustomizers(builder -> builder.setServerOption(UndertowOptions.ALLOW_ENCODED_SLASH, Boolean.TRUE));
        factory.addDeploymentInfoCustomizers(deploymentInfo -> {
            WebResourceCollection webResourceCollection = new WebResourceCollection();
            webResourceCollection.addUrlPattern("/*");
            webResourceCollection.addHttpMethod(HttpMethod.HEAD.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PUT.toString());
            webResourceCollection.addHttpMethod(HttpMethod.PATCH.toString());
            webResourceCollection.addHttpMethod(HttpMethod.DELETE.toString());
            webResourceCollection.addHttpMethod(HttpMethod.OPTIONS.toString());
            webResourceCollection.addHttpMethod(HttpMethod.TRACE.toString());

            SecurityConstraint constraint = new SecurityConstraint();
            constraint.addWebResourceCollection(webResourceCollection);

            deploymentInfo.addSecurityConstraint(constraint);
        });
    }
}