HiGopi Forum

As you might have already known, The WEB-INF directory is 'special'; anything under it is not to be served directly to web clients as it contains Java class files (for servlets etc) and configuration information for the web application. Hence, when an application server receives any requests for /WEB-INF/ it will usually return a '403 forbidden' or even a '404 Not Found' HTTP error.

A vulnerability exists in multiple Win32 servlet engines whereby if you append a dot ('.') to the end of WEB-INF in the requested URL, it is possible to retrieve the contents of any files within that directory.

For example:

http://www.someserver.com/WEB-INF./web.xml

If your server is not based on Win32, you don't need to worry about it or else you need to patch your Application server product for this vulnerability.

Coming back to your question, ideally it should not create any problem if you store your user upload files under /WEB-INF/upload/files/.

You should be able to write and retrieve the files using the physical path of the directory. The server won't load any other directory than the standard J2EE web application directories (like /WEB-INF/lib/ or /WEB-INF/classes/ ). So it wont be a problem even if the /WEB-INF/upload/files/ grows day by day.

But its not advisable to use /WEB-INF/ directory for any other purpose like this. So I would suggest you to use any other file system directory (like /var/upload/files or /home/user/upload/files)

Hi Vijay,


//If the user knows the path they can access all the files list and view directly. //

I am not getting what you say. Do you mean all the users have telnet/ssh access to your server? even then, only if the user knows the path they can access it. If so, even they can read all the JSP source files and crack the business logic used in your code.

If they don't have any other access to the server except web access, then we won't be having our directory (/var/upload/files or /home/user/upload/files) mapped in any of the web path in the application server configuration file. so the users cannot access this path from web browser directly.

But at the same time you can use Java file read/write API to implement the upload and download. Also you can implement the user authentication and authorization from JSP.

===================
ORIGINAL POST DELETED!!!!
===================

Hi Alfred,

Original content of this post violates the following:

"No Marketing/Donation/Promotion posts"

Hence, its deleted. If this is repeated, your user account may be banned.

- Admin

Last edited by Alfred (13-Dec-2010,Mon 13:10:39)