Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.

I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.

I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.

Are there other solutions?

share|improve this question
Why devs cant block it themselves? – Andrew Smith Sep 1 '12 at 13:00

Just put this in the .htaccess file:

Order Allow,Deny
Allow from all
<Files /web.xml>
    Order Deny,Allow
    Deny from all
    Allow from

Let's run through this one line at a time:

  1. Order Allow,Deny - Allow all requests that don't match a htaccess rule.
  2. Allow from all - Allow all requests. We override this rule later with more specific rules.
  3. <Files /web.xml> - Apply the next set of rules to files that match /web.xml. This block overrides the rules set above.
  4. Order Deny,Allow - Deny all requests that don't match a htaccess rule within this block.
  5. Deny from all - Deny all requests. Again, we override this rule with a more specific one.
  6. Allow from - Allow any request from for /web.xml.
  7. </Files> - End the block we started on line 3.

Essentially, this leaves us with "for all files except web.xml, allow all requests. for web.xml, deny all requests unless they're from".

share|improve this answer

If you want to block web.xml without touching application, you can use modsecurity with IIS setup as reverse proxy server

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.