feat(web): 添加 Undertow 自定义配置和默认配置，默认禁止三个不安全的 HTTP 方法（如 CONNECT、TRACE、TRACK）

continew-starter-web/src/main/java/top/continew/starter/web/autoconfigure/container/UndertowAutoConfiguration.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2022-present Charles7c Authors. All Rights Reserved.
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package top.continew.starter.web.autoconfigure.container;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
+import org.springframework.boot.web.server.WebServerFactoryCustomizer;
+import org.springframework.context.annotation.Bean;
+
+import io.undertow.Undertow;
+import io.undertow.server.handlers.DisallowedMethodsHandler;
+import io.undertow.util.HttpString;
+
+/**
+ * Undertow 自定义配置
+ *
+ * @author Jasmine
+ * @since 2.11.0
+ */
+@AutoConfiguration
+@ConditionalOnWebApplication
+@ConditionalOnClass(Undertow.class)
+public class UndertowAutoConfiguration {
+
+    private static final Logger log = LoggerFactory.getLogger(UndertowAutoConfiguration.class);
+
+    /**
+     * Undertow 自定义配置
+     */
+    @Bean
+    public WebServerFactoryCustomizer<UndertowServletWebServerFactory> customize() {
+        return factory -> {
+            factory.addDeploymentInfoCustomizers(deploymentInfo -> deploymentInfo
+                .addInitialHandlerChainWrapper(handler -> {
+                    // 禁止三个不安全的 HTTP 方法（如 CONNECT、TRACE、TRACK）
+                    HttpString[] disallowedHttpMethods = {HttpString.tryFromString("CONNECT"), HttpString
+                        .tryFromString("TRACE"), HttpString.tryFromString("TRACK")};
+                    return new DisallowedMethodsHandler(handler, disallowedHttpMethods);
+                }));
+            log.debug("[ContiNew Starter] - Auto Configuration 'Web-Undertow' completed initialization.");
+        };
+    }
+}