一家安全公司标记了我们的Sping Boot 2.3.4应用程序在发送HTTP TRACE请求时返回的错误响应。我们使用的Tomcat容器默认情况下已禁用HTTP TRACE，但响应包含TRACE信息。以下是输出：

$ curl -k -i -X TRACE --cookie "VULNERABLE=Yes" http://localhost:9090

HTTP/1.1 405
Allow: HEAD, DELETE, POST, GET, OPTIONS, PUT
Content-Type: message/http
Content-Length: 116
Date: Fri, 16 Oct 2020 20:41:51 GMT

TRACE /error HTTP/1.1
host: localhost:9090
user-agent: curl/7.64.1
accept: */*
cookie: VULNERABLE=Yes

我能够改变这一点的唯一方法是在用“@Configuration”注解的配置类中使用以下代码启用HTTP TRACE请求：

@Bean
    public WebServerFactoryCustomizer<TomcatServletWebServerFactory> tomcatCustomizer() {
        return customizer -> customizer.addConnectorCustomizers(connector -> {
            connector.setAllowTrace(true);  // filtered in the SecurityFilter with custom error
        });
    }

然后，我添加了一个servlet过滤器来拦截请求并返回自定义响应：

@Component
@Order(1)
public class SecurityFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    @Override
    public void doFilter(ServletRequest servletRequest,
                         ServletResponse servletResponse,
                         FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        if (HttpMethod.TRACE.name().equals(request.getMethod())) {
            // trace not allowed
            HttpServletResponse response = (HttpServletResponse) servletResponse;
            response.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
            response.setContentType("message/http");
            response.getWriter().println("TRACE method not allowed");
            response.getWriter().flush();
            return;
        }
        filterChain.doFilter(servletRequest,servletResponse);
    }

    @Override
    public void destroy() {
    }
}

来自同一个curl请求的响应是：

HTTP/1.1 405 
Content-Type: message/http;charset=ISO-8859-1
Transfer-Encoding: chunked
Date: Thu, 12 Nov 2020 19:11:13 GMT

TRACE method not allowed

有人遇到过类似的问题吗？似乎启用跟踪只是为了能够更改响应正文并不是一个好主意。