J2EE Misconfiguration: Invalid Servlet Name

ABSTRACT

無效的 servlet 名稱會造成用戶無法正常訪問所需的 Servlet。

EXPLANATION

web.xml 中缺少 servlet 名稱或包含重復的 servlet 名稱均為錯誤。每個 Servlet 都應有一個唯一的名稱 (servlet-name) 及相應的映射 (servlet-mapping)。



例 1：以下 web.xml 中的條目顯示了幾個錯誤的 servlet 定義。

<!-- No <servlet-name> specified:-->
<servlet>
<servlet-class>com.class.MyServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>

<!-- Empty <servlet-name> node:-->
<servlet>
<servlet-name/>
<servlet-class>com.class.MyServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>

<!-- Duplicate <servlet-name> nodes:-->
<servlet>
<servlet-name>MyServlet</servlet-name>
<servlet-name>Servlet</servlet-name>
<servlet-class>com.class.MyServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>

REFERENCES

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A9 Application Denial of Service

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP6080 CAT II

[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP6080 CAT II

[4] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 730

[5] Sun Microsystems, Inc. Java Servlet Specification 2.4

[6] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.9