tomcat 安全记述

最新推荐文章于 2021-03-20 07:32:02 发布

weixin_34138056

最新推荐文章于 2021-03-20 07:32:02 发布

阅读量61

点赞数

文章标签： java python

原文链接：https://my.oschina.net/9199771/blog/2961292

版权

2019独角兽企业重金招聘Python工程师标准>>>

<servlet>
        <servlet-name>jsp</servlet-name>
        <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
        <init-param>
            <param-name>fork</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>xpoweredBy</param-name>
            <param-value>false</param-value>
        </init-param>
        <load-on-startup>3</load-on-startup>
    </servlet>

和

<servlet-mapping>
        <servlet-name>jsp</servlet-name>
        <url-pattern>*.jsp</url-pattern>
        <url-pattern>*.jspx</url-pattern>
    </servlet-mapping>

在tomcat的web.xml中注释掉这两段 tomcat就会不再执行jsp代码了彻底杜绝jsp类型的webshell，对于那种外部容器类的tomcat是很好的缓解方案

Jasper是tomcat中使用的JSP引擎，文中阻止org.apache.jasper.servlet.JspServlet就是为了阻止jsp的映射和解析

我们可以对conf下的xml进一步修改只让他支持GET POST两个动词

    <security-constraint>  
        <web-resource-collection>  
            <url-pattern>/*</url-pattern>  
            <http-method>HEAD</http-method>  			
            <http-method>PUT</http-method>  
            <http-method>DELETE</http-method>  
            <http-method>OPTIONS</http-method>  
            <http-method>TRACE</http-method>
        </web-resource-collection>  
        <auth-constraint>  
        </auth-constraint>  
    </security-constraint>    
 
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

可以先寻找default再在上面如此设置

转载于:https://my.oschina.net/9199771/blog/2961292