Re: JSP Security exposure (from usenet)

["David Morris" <David.Morris@xxxxxxxxxxxxx>]

Brad,

That is not good but it shouldn't be the end of the world. I have not
seen
that behavior with Tomcat on the iSeries. It is possible to write your
entire
application in with JSP page logic, but that would not be a good
approach.
It is better to have some sort of controller Servlet that fields
requests and
directs the response to an appropriate JSP.

David Morris

>>> brad@bvstools.com 11/13/01 09:52PM >>>
Hey, I just read this on Usenet.  I don't recall seeing it
here.

Apparently if you call a JSP and end it with a slash "/" it
will show the source for the JSP.

ie:
www.myserver.com/runme.jsp

will function normally.  But

www.myserver.com/runme.jsp/

will display the source for the JSP.  I haven't tried it,
but the poster on comp.sys.ibm.as400.misc said he has.  He
didn't mention if it was for Websphere or Tomcat.

Anyone... Bueller?