-
Bug
-
Resolution: Done
-
Major
-
2.2.13.Final, 2.2.20.SP1
-
None
Top level WEB-INF and META-INF directories should not be exposed. But other application sub directories may be named this and should in theory be allowed. These were allowed prior to UNDERTOW-1981.
- is caused by
-
UNDERTOW-1981 Unify DefaultServlet & ServletInitialHandler in handling forbidden subpaths
- Resolved
- is cloned by
-
JBEAP-24093 [GSS](7.4.z) UNDERTOW-2186 - Application sub directories named WEB-INF or META-INF are no longer served
- Closed