<servlet>
<servlet-name>jsp</servlet-name>
<servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
<init-param>
<param-name>fork</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>xpoweredBy</param-name>
<param-value>false</param-value>
</init-param>
<load-on-startup>3</load-on-startup>
</servlet>
和
<servlet-mapping>
<servlet-name>jsp</servlet-name>
<url-pattern>*.jsp</url-pattern>
<url-pattern>*.jspx</url-pattern>
</servlet-mapping>
在tomcat的web.xml中注释掉 这两段 tomcat就会不再执行jsp代码了 彻底杜绝jsp类型的webshell,对于那种外部容器类的tomcat是很好的缓解方案
Jasper是tomcat中使用的JSP引擎,文中阻止org.apache.jasper.servlet.JspServlet就是为了阻止jsp的映射和解析
我们可以对conf下的xml进一步修改只让他支持GET POST两个动词
<security-constraint>
<web-resource-collection>
<url-pattern>/*</url-pattern>
<http-method>HEAD</http-method>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint>
</auth-constraint>
</security-constraint>
<servlet-mapping>
<servlet-name>default</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
可以先寻找default再在上面如此设置