[grid] Disabling TRACE method in hub
import org.openqa.selenium.remote.server.jmx.JMXHelper;
import org.openqa.selenium.remote.server.jmx.ManagedAttribute;
import org.openqa.selenium.remote.server.jmx.ManagedService;
+import org.seleniumhq.jetty9.security.ConstraintMapping;
+import org.seleniumhq.jetty9.security.ConstraintSecurityHandler;
import org.seleniumhq.jetty9.server.HttpConfiguration;
import org.seleniumhq.jetty9.server.HttpConnectionFactory;
import org.seleniumhq.jetty9.server.Server;
import org.seleniumhq.jetty9.server.ServerConnector;
import org.seleniumhq.jetty9.servlet.ServletContextHandler;
import org.seleniumhq.jetty9.servlet.ServletHolder;
+import org.seleniumhq.jetty9.util.security.Constraint;
import org.seleniumhq.jetty9.util.thread.QueuedThreadPool;
import java.net.BindException;
@@ -181,8 +184,28 @@ private void initServer() {
server.addConnector(http);
- ServletContextHandler root = new ServletContextHandler(ServletContextHandler.SESSIONS);
+ ServletContextHandler root = new ServletContextHandler(ServletContextHandler.SESSIONS + ServletContextHandler.SECURITY);
root.setContextPath("/");
+
+ ConstraintSecurityHandler securityHandler = (ConstraintSecurityHandler) root.getSecurityHandler();
+
+ Constraint disableTrace = new Constraint();
+ disableTrace.setName("Disable TRACE");
+ disableTrace.setAuthenticate(true);
+ ConstraintMapping disableTraceMapping = new ConstraintMapping();
+ disableTraceMapping.setConstraint(disableTrace);
+ disableTraceMapping.setMethod("TRACE");
+ disableTraceMapping.setPathSpec("/");
+ securityHandler.addConstraintMapping(disableTraceMapping);
+
+ Constraint enableOther = new Constraint();
+ enableOther.setName("Enable everything but TRACE");
+ ConstraintMapping enableOtherMapping = new ConstraintMapping();
+ enableOtherMapping.setConstraint(enableOther);
+ enableOtherMapping.setMethodOmissions(new String[] {"TRACE"});
+ enableOtherMapping.setPathSpec("/");
+ securityHandler.addConstraintMapping(enableOtherMapping);
+
server.setHandler(root);
root.setAttribute(GridRegistry.KEY, registry);
