Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Should we allow JSPs to change on a running application server on a production system?

My gut feeling is no. However, I can't seem to find any information to justify it.

From a performance end, having to detect and recompile the JSPs will cause slow down for the user. You also lose the capability of precompiling the JSPs to prevent the first user hit.

From a security end, it feels like allowing someone who has access to a content management system to run a CGI file.

share|improve this question
How would they be changing and who would be changing them? – Abe Miessler Aug 29 '13 at 16:58
Let's say it's through a CMS that "publishes" JSP files from non-development team such as content providers. – Archimedes Trajano Aug 29 '13 at 19:30
I wouldn't recommend running code that you have not tested in a separate environment. If you do need to run third party code you would need to think of things like sandboxing, filtering, automated code review, etc. – Eric G Sep 8 '13 at 6:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.