Make OPTIONS/TRACE request handling configurable

Add properties to WebMvcProperties allowing control of if TRACE/OPTIONS
requests should go through the regular dispatching chain.

Closes spring-projectsgh-4300

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/DispatcherServletAutoConfiguration.java

@@ -91,6 +91,10 @@ protected static class DispatcherServletConfiguration {
 		@Bean(name = DEFAULT_DISPATCHER_SERVLET_BEAN_NAME)
 		public DispatcherServlet dispatcherServlet() {
 			DispatcherServlet dispatcherServlet = new DispatcherServlet();
+			dispatcherServlet.setDispatchOptionsRequest(
+					this.webMvcProperties.isDispatchOptionsRequest());
+			dispatcherServlet.setDispatchTraceRequest(
+					this.webMvcProperties.isDispatchTraceRequest());
 			dispatcherServlet.setThrowExceptionIfNoHandlerFound(
 					this.webMvcProperties.isThrowExceptionIfNoHandlerFound());
 			return dispatcherServlet;

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/WebMvcProperties.java

@@ -51,6 +51,16 @@ public class WebMvcProperties {
 	 */
 	private String dateFormat;
 
+	/**
+	 * Dispatch TRACE requests to the FrameworkServlet doService method.
+	 */
+	private boolean dispatchTraceRequest = false;
+
+	/**
+	 * Dispatch OPTIONS requests to the FrameworkServlet doService method.
+	 */
+	private boolean dispatchOptionsRequest = false;
+
 	/**
 	 * If the content of the "default" model should be ignored during redirect scenarios.
 	 */
@@ -121,6 +131,22 @@ public void setMediaTypes(Map<String, MediaType> mediaTypes) {
 		this.mediaTypes = mediaTypes;
 	}
 
+	public boolean isDispatchOptionsRequest() {
+		return this.dispatchOptionsRequest;
+	}
+
+	public void setDispatchOptionsRequest(boolean dispatchOptionsRequest) {
+		this.dispatchOptionsRequest = dispatchOptionsRequest;
+	}
+
+	public boolean isDispatchTraceRequest() {
+		return this.dispatchTraceRequest;
+	}
+
+	public void setDispatchTraceRequest(boolean dispatchTraceRequest) {
+		this.dispatchTraceRequest = dispatchTraceRequest;
+	}
+
 	public Async getAsync() {
 		return this.async;
 	}

spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/DispatcherServletAutoConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2014 the original author or authors.
+ * Copyright 2012-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -155,10 +155,18 @@ public void dispatcherServletConfig() {
 				DispatcherServletAutoConfiguration.class);
 		EnvironmentTestUtils.addEnvironment(this.context,
 				"spring.mvc.throw-exception-if-no-handler-found:true");
+		EnvironmentTestUtils.addEnvironment(this.context,
+				"spring.mvc.dispatch-options-request:true");
+		EnvironmentTestUtils.addEnvironment(this.context,
+				"spring.mvc.dispatch-trace-request:true");
 		this.context.refresh();
 		DispatcherServlet bean = this.context.getBean(DispatcherServlet.class);
 		assertEquals(true, new DirectFieldAccessor(bean)
 				.getPropertyValue("throwExceptionIfNoHandlerFound"));
+		assertEquals(true,
+				new DirectFieldAccessor(bean).getPropertyValue("dispatchOptionsRequest"));
+		assertEquals(true,
+				new DirectFieldAccessor(bean).getPropertyValue("dispatchTraceRequest"));
 	}
 
 	@Configuration

spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc

@@ -302,7 +302,9 @@ content into your application; rather pick only the properties that you need.
 
 	# SPRING MVC ({sc-spring-boot-autoconfigure}/web/WebMvcProperties.{sc-ext}[WebMvcProperties])
 	spring.mvc.async.request-timeout= # Amount of time (in milliseconds) before asynchronous request handling times out.
-	spring.mvc.date-format= # Date format to use. For instance `dd/MM/yyyy`
+	spring.mvc.date-format= # Date format to use. For instance `dd/MM/yyyy`.
+	spring.mvc.dispatch-trace-request=false # Dispatch TRACE  requests to the FrameworkServlet doService method.
+	spring.mvc.dispatch-options-request=false # Dispatch OPTIONS requests to the FrameworkServlet doService method.
 	spring.mvc.favicon.enabled=true # Enable resolution of favicon.ico.
 	spring.mvc.ignore-default-model-on-redirect=true # If the content of the "default" model should be ignored during redirect scenarios.
 	spring.mvc.locale= # Locale to use.