CODEWITHSUNDEEP
securitywildfly
dhartford
dhartford

Reputation: 1149

wildfly/undertow - how to disable folder/file listing

I currently use this setting in my web.xml within my WAR's to ensure that, regardless if the container is properly configured or not, that the application itself does not list files/folders directly through the web:

    <servlet>
        <servlet-name>DefaultNoListing</servlet-name>
        <servlet-class>org.apache.catalina.servlets.DefaultServlet
        </servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>false</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
....
    <servlet-mapping>
        <servlet-name>DefaultNoListing</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

Question: How can one do something similar when deploying to Wildfly/Undertow, such that each application can ensure no folder/file listing regardless how the server is configured?

-D

Upvotes: 1

Views: 4276

Answers (2)

Tomaz Cerar
Tomaz Cerar

Reputation: 5791

As an update, this feature was now implemented and will be part of WildFly 8.0.1

you can modify default servlet behavior with configuration like this:

 <servlet>
      <servlet-name>default</servlet-name>
      <servlet-class>io.undertow.servlet.handlers.DefaultServlet</servlet-class>
      <init-param>
          <param-name>directory-listing</param-name>
          <param-value>true</param-value>
      </init-param>
 </servlet>

This will override configuration for default servlet and will enable directory listing. By default listings are disabled.

Upvotes: 4

Tomaz Cerar
Tomaz Cerar

Reputation: 5791

Currently default servlet does not support listing folders at all in Undertow/WildFly.

It is something we missed when implementing it.

I created https://issues.jboss.org/browse/UNDERTOW-195 for implementing this.

Once we have it implemented, you would be able to configure it similarly as you do now just class name is 

io.undertow.servlet.handlers.DefaultServlet

Upvotes: 1

Related Questions