Ensure Web Server Document Root does not contain information that should be private

높음레벨 1수동 검토websphere

설명

WAR files contain servable content. The Web container will serve any files found in the root(Web Server Document Root) of the WAR file. This is fine as long as you place only servable content in the root. Thus, you should never place content that shouldn't be shown to users in the root of the WAR. For example, don't put property files, class files, or other important information there. If you must place such information in the WAR file, place it within the WEB-INF directory, as permitted by the servlet specification. Information there is never served by the Web. TMAegis cannot evaluate this reliably, so it is reported as a manual review item with the audit steps.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Ensure that there is no content that shouldn't be shown to users in the root of the WAR. For example, check for property files, class files, or other important information.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remove all content that shouldn't be shown to users in the root of the WAR. For example, relocate property files, class files, or other important information within the WEB-INF directory, as permitted by the servlet specification.

속성

운영 체제: 모두
태그: webspheremanual-review
참고 자료: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.4.15 Ensure Web Server Document Root does not contain information that should be private