how to block access to http get web-inf files

[Jim Boden]

We have wildfly 20 mostly default standalone config, deployed exploded. I can go to https://localhost/WEB-INF/web.xml and it shows me the file. It will show any file under the WEB-INF or entire root tree.

But this of course should not be GET-able. Did we just miss some simple config to block access via GET?

Thank you

[Paul Ferraro]

This is a regression that was fixed in WildFly 24.

You should be able to workaround it by adding a security constraint to your web.xml, e.g.

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>private</web-resource-name>
            <url-pattern>/WEB-INF/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>forbidden</role-name>
        </auth-constraint>
    </security-constraint>

[Jim Boden]

Thank you Paul,

I see how this should have worked but it still does not. Not sure if I should, but I don't see any logs either. Could it be that this constraint only applies for URLs below the app name since it's in the app's web.xml? Like localhost/myapp/etc....

But here I'm getting:

localhost/WEB-INF/web.xml

with no app in the URL and it still displays. I removed all other security-constraints to be sure, and tried with and without a role name.

I'm not sure when I can move to a later release, so very much appeciate any other ideas.

Thank you!

[Paul Ferraro]

Are you able to reproduce this problem on a more recent release?

[Jim Boden]

Thanks for the follow-up. I wasn't able to update to a later version so could not test. It might be a while before we upgrade. I ended up adding a location handler to the undertow default-server like:

                 <host name="default-host" alias="localhost">

                    <location name="/WEB-INF" handler="block"/>
                    <location name="/META-INF" handler="block"/>

                </host>

Then the handler is just something silly that redirects me back to the app login page:

            <handlers>

                        <file name=" block" path="${jboss.home.dir}/standalone/deployments/myapp.war/login.htm"/>

            </handlers>

This did work. I don't know why the constraint did not work, unless maybe because the web-inf is not in my app path, perhaps it did not register the constraint since that's in my app web.xml. But this handler did the trick so we moved on. :-)

Thank you!

[Bartosz Baranowski]

WDYM "web-inf is not in my app path" ?
Could you please detail app setup in case thats a real flaw?