Wildfly目录遍历

Question

我正在使用Wildfly 10.1.0。当我部署我的WAR文件时，我遇到了一个目录遍历错误，我可以访问WEB-INF文件夹下的任何文件。

http://localhost:8080/home.html;//WEB-INF/web.xml

有没有办法阻止这种情况？

Answer 1

我们最终编写了一个过滤器，以便在有人将其键入URL

时明确禁止访问

public void doFilter(ServletRequest servRequest, ServletResponse servResponse, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request   = (HttpServletRequest ) servRequest;
    HttpServletResponse response = (HttpServletResponse) servResponse;


    if (request.getRequestURI().matches("(?i).*(WEB-INF).*")) {
        response.sendError(401, "You are not authorized to fetch this resource");
        return;
    }