Ensure Web Server Document Root does not contain information that should be private

TinggiLevel 1Tinjauan manualwebsphere

Deskripsi

WAR files contain servable content. The Web container will serve any files found in the root(Web Server Document Root) of the WAR file. This is fine as long as you place only servable content in the root. Thus, you should never place content that shouldn't be shown to users in the root of the WAR. For example, don't put property files, class files, or other important information there. If you must place such information in the WAR file, place it within the WEB-INF directory, as permitted by the servlet specification. Information there is never served by the Web. TMAegis cannot evaluate this reliably, so it is reported as a manual review item with the audit steps.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Ensure that there is no content that shouldn't be shown to users in the root of the WAR. For example, check for property files, class files, or other important information.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remove all content that shouldn't be shown to users in the root of the WAR. For example, relocate property files, class files, or other important information within the WEB-INF directory, as permitted by the servlet specification.

Properti

Sistem operasi: Apa saja
Tag: webspheremanual-review
Referensi: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.4.15 Ensure Web Server Document Root does not contain information that should be private