Tim Panton wrote: > > A common theme is that they all use lexical analysis of a request > string to determine if a request should be blocked (say because it > accesses WEB-INFO or goes outside the web root). >
You're saying that lexical analysis of the request URI is fundamentally a flawed approach? In what way, exactly? > Why have container authors not chosen to use the java security > mechanism to restrict file access? > I suspect mainly because its a major pain to get working correctly. Tomcat 4 has an option to run with a security manager. You can grep for 'SecurityManager' and 'doPrivileged' to get an idea for the kind of hoops you need to jump through. In any case, I suspect using the security stuff for controlling access to WEB-INF would be awkward. The restriction is that the nothing in WEB-INF can be served _directly_ to the client, but the servlet still has full access to the directory and the container obviously has to have full access. Which security domain would you deny access? -- Christopher St. John [EMAIL PROTECTED] DistribuTopia http://www.distributopia.com ___________________________________________________________________________ To unsubscribe, send email to [EMAIL PROTECTED] and include in the body of the message "signoff SERVLET-INTEREST". Archives: http://archives.java.sun.com/archives/servlet-interest.html Resources: http://java.sun.com/products/servlet/external-resources.html LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
