RSE-1052: fix IP disclosure when request doesnt have Host header

rundeckapp/grails-app/conf/spring/resources.groovy

@@ -880,13 +880,15 @@ beans={
     }
 
     jettyServletCustomizer(JettyServletContainerCustomizer) {
+        featureService = ref('featureService')
         def configParams = grailsApplication.config.getProperty("rundeck.web.jetty.servlet.initParams", String.class)
         def useForwardHeadersConfig = grailsApplication.config.getProperty("server.useForwardHeaders",Boolean.class)
 
         initParams = configParams?.toProperties()?.collectEntries {
             [it.key.toString(), it.value.toString()]
         }
         useForwardHeaders = useForwardHeadersConfig ?: Boolean.getBoolean('rundeck.jetty.connector.forwarded')
+        serverUrl = grailsApplication.config.getProperty('grails.serverURL', String.class)
     }
 
     def stsMaxAgeSeconds = grailsApplication.config.getProperty("rundeck.web.jetty.servlet.stsMaxAgeSeconds",Integer.class,-1)

rundeckapp/grails-app/init/rundeckapp/init/servlet/JettyServletContainerCustomizer.groovy

@@ -17,6 +17,7 @@ package rundeckapp.init.servlet
 
 import com.dtolabs.rundeck.core.init.CustomWebAppInitializer
 import org.eclipse.jetty.server.Handler
+import org.eclipse.jetty.server.HostHeaderCustomizer
 import org.eclipse.jetty.server.Server
 import org.eclipse.jetty.server.handler.ContextHandler
 import org.eclipse.jetty.webapp.AbstractConfiguration
@@ -26,6 +27,7 @@ import org.slf4j.LoggerFactory
 import org.springframework.boot.web.embedded.jetty.JettyServerCustomizer
 import org.springframework.boot.web.embedded.jetty.JettyServletWebServerFactory
 import org.springframework.boot.web.server.WebServerFactoryCustomizer
+import rundeck.services.feature.FeatureService
 
 /**
  * Customize embedded jetty
@@ -36,6 +38,8 @@ class JettyServletContainerCustomizer implements WebServerFactoryCustomizer<Jett
      */
     Map<String, String> initParams = [:]
     Boolean useForwardHeaders
+    String serverUrl
+    FeatureService featureService
 
     @Override
     void customize(final JettyServletWebServerFactory factory) {
@@ -50,6 +54,9 @@ class JettyServletContainerCustomizer implements WebServerFactoryCustomizer<Jett
             }
         })
         factory.addServerCustomizers(new BanHttpMethodCustomizer())
+        if(serverUrl && featureService.featurePresent("setServerUrlOnNoHostHeader", false)) {
+            factory.addServerCustomizers(new RundeckHostHeaderCustomizer(serverUrl: serverUrl))
+        }
         factory.addConfigurations(new JettyConfigPropsInitParameterConfiguration(initParams))
         factory.useForwardHeaders=useForwardHeaders
     }

rundeckapp/grails-app/init/rundeckapp/init/servlet/RundeckHostHeaderCustomizer.groovy

@@ -0,0 +1,19 @@
+package rundeckapp.init.servlet
+
+import org.eclipse.jetty.server.HostHeaderCustomizer
+import org.eclipse.jetty.server.HttpConfiguration
+import org.eclipse.jetty.server.HttpConnectionFactory
+import org.eclipse.jetty.server.Server
+import org.springframework.boot.web.embedded.jetty.JettyServerCustomizer
+
+class RundeckHostHeaderCustomizer implements JettyServerCustomizer {
+    String serverUrl
+
+    @Override
+    void customize(Server server) {
+        server.connectors.each {connector ->
+            HttpConfiguration config = connector.getConnectionFactory(HttpConnectionFactory.class).httpConfiguration
+            config.addCustomizer(new HostHeaderCustomizer(serverUrl))
+        }
+    }
+}