From 29736e340e4bb6c626b1ea7125a0092356710089 Mon Sep 17 00:00:00 2001
From: Alex Panchenko <alex.panchenko@gmail.com>
Date: Mon, 29 Jan 2018 23:31:54 +0700
Subject: [PATCH] Configure ErrorReportValve not to report stack traces

See gh-11790
---
 .../autoconfigure/web/ServerProperties.java   | 21 +++++++++++++++++++
 ...TomcatEmbeddedServletContainerFactory.java |  2 +-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
index f15dc35a42..514ed0dc2c 100644
--- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
@@ -36,7 +36,9 @@ import io.undertow.UndertowOptions;
 import org.apache.catalina.Context;
 import org.apache.catalina.connector.Connector;
 import org.apache.catalina.valves.AccessLogValve;
+import org.apache.catalina.valves.ErrorReportValve;
 import org.apache.catalina.valves.RemoteIpValve;
+import org.apache.commons.logging.LogFactory;
 import org.apache.coyote.AbstractProtocol;
 import org.apache.coyote.ProtocolHandler;
 import org.apache.coyote.http11.AbstractHttp11Protocol;
@@ -859,6 +861,25 @@ public class ServerProperties
 			if (!ObjectUtils.isEmpty(this.additionalTldSkipPatterns)) {
 				factory.getTldSkipPatterns().addAll(this.additionalTldSkipPatterns);
 			}
+			if (serverProperties.getError().getIncludeStacktrace() == ErrorProperties.IncludeStacktrace.NEVER) {
+				factory.addContextCustomizers(new TomcatContextCustomizer() {
+					@Override
+					public void customize(Context context) {
+						// org.apache.catalina.core.StandardHost() adds ErrorReportValve
+						// with default options if not there yet, so adding a properly
+						// configured one.
+						ErrorReportValve valve = new ErrorReportValve();
+						valve.setShowServerInfo(false); // disable server name and version
+						valve.setShowReport(false); // disable exception
+						if (context.getParent() != null) {
+							context.getParent().getPipeline().addValve(valve);
+						} else {
+							LogFactory.getLog(context.getClass()).warn("Parent of " + context
+									+ " is not set, skip ErrorReportValve configuration");
+						}
+					}
+				});
+			}
 		}
 
 		private void customizeAcceptCount(TomcatEmbeddedServletContainerFactory factory) {
diff --git a/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java b/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java
index 4e012a862d..5094113a49 100644
--- a/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java
+++ b/spring-boot/src/main/java/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java
@@ -231,8 +231,8 @@ public class TomcatEmbeddedServletContainerFactory
 
 		});
 		ServletContextInitializer[] initializersToUse = mergeInitializers(initializers);
-		configureContext(context, initializersToUse);
 		host.addChild(context);
+		configureContext(context, initializersToUse);
 		postProcessContext(context);
 	}