Allow custom ErrorReportValve to be used with Tomcat and provide whitelabel version

During a penetration test one finding was the information disclosure of using a Tomcat webserver.

If a request with an invalid URL (e.g. http://localhost:8080/[test ) is executed the configured custom error pages are not used.
Instead the embedded Tomcats ErrorReportValve is used and presents a default Tomcat Error page.

It is possible to configure it to some extends using

• server.error.whitelabel.enabled=false
• server.error.include-stacktrace=never

But the default HTTP Status 400 page is always returned.

It is possible to create a custom ErrorReportValve and set the properties like errorCode.400 to create a custom page, but this configuration is not possible with an application.properties file.

(At least as far as I can see)
See an example project at https://github.com/patst/tomcat-errorvalve

Maybe it would be a good idea to expose the properties for configuration.

The ErrorReportValve is created at https://github.com/spring-projects/spring-boot/blob/767156167b4d1d91c8af0e5bff2d1be0d5149651/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java#L295

What do you think?

Start with spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java at the ErrorReportValve creation. Review the issue discussion and the linked example project to understand the requested application.properties configuration and whitelabel behavior. Done means the custom valve or equivalent error-page configuration can be supplied through supported properties and invalid URLs no longer disclose the default Tomcat page.