Ensure Web Server Document Root does not contain information that should be private

ÉlevéeNiveau 1Revue manuellewebsphere

Description

WAR files contain servable content. The Web container will serve any files found in the root(Web Server Document Root) of the WAR file. This is fine as long as you place only servable content in the root. Thus, you should never place content that shouldn't be shown to users in the root of the WAR. For example, don't put property files, class files, or other important information there. If you must place such information in the WAR file, place it within the WEB-INF directory, as permitted by the servlet specification. Information there is never served by the Web. TMAegis cannot evaluate this reliably, so it is reported as a manual review item with the audit steps.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Ensure that there is no content that shouldn't be shown to users in the root of the WAR. For example, check for property files, class files, or other important information.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Remove all content that shouldn't be shown to users in the root of the WAR. For example, relocate property files, class files, or other important information within the WEB-INF directory, as permitted by the servlet specification.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: webspheremanual-review
Référence: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.4.15 Ensure Web Server Document Root does not contain information that should be private