Ensure Web Server Document Root does not contain information that should be private

AltaNivel 1Revisión manualwebsphere

Descripción

WAR files contain servable content. The Web container will serve any files found in the root(Web Server Document Root) of the WAR file. This is fine as long as you place only servable content in the root. Thus, you should never place content that shouldn't be shown to users in the root of the WAR. For example, don't put property files, class files, or other important information there. If you must place such information in the WAR file, place it within the WEB-INF directory, as permitted by the servlet specification. Information there is never served by the Web. TMAegis cannot evaluate this reliably, so it is reported as a manual review item with the audit steps.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Ensure that there is no content that shouldn't be shown to users in the root of the WAR. For example, check for property files, class files, or other important information.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remove all content that shouldn't be shown to users in the root of the WAR. For example, relocate property files, class files, or other important information within the WEB-INF directory, as permitted by the servlet specification.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: webspheremanual-review
Referencia: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.4.15 Ensure Web Server Document Root does not contain information that should be private