From 95b309a9b93eebadb589a335947598d815add80b Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Sun, 2 Mar 2014 21:13:38 +0100
Subject: [PATCH] Adds security constraints to web.xml to block access to pure
 JSP files

---
 apps/blank/src/main/webapp/WEB-INF/web.xml      |  5 +++++
 .../jboss-blank/src/main/webapp/WEB-INF/web.xml |  3 ---
 apps/mailreader/src/main/webapp/WEB-INF/web.xml | 17 +++++++++++++++++
 apps/portlet/src/main/webapp/WEB-INF/web.xml    | 17 +++++++++++++++++
 .../src/main/webapp/WEB-INF/web.xml             | 17 +++++++++++++++++
 apps/showcase/src/main/webapp/WEB-INF/web.xml   | 17 +++++++++++++++++
 6 files changed, 73 insertions(+), 3 deletions(-)

diff --git a/apps/blank/src/main/webapp/WEB-INF/web.xml b/apps/blank/src/main/webapp/WEB-INF/web.xml
index e8c0f4654..f15252bb9 100644
--- a/apps/blank/src/main/webapp/WEB-INF/web.xml
+++ b/apps/blank/src/main/webapp/WEB-INF/web.xml
@@ -31,4 +31,9 @@
         </auth-constraint>
     </security-constraint>
 
+    <security-role>
+        <description>Don't assign users to this role</description>
+        <role-name>no-users</role-name>
+    </security-role>
+
 </web-app>
diff --git a/apps/jboss-blank/src/main/webapp/WEB-INF/web.xml b/apps/jboss-blank/src/main/webapp/WEB-INF/web.xml
index 88c6fc8e5..d1cf0209c 100644
--- a/apps/jboss-blank/src/main/webapp/WEB-INF/web.xml
+++ b/apps/jboss-blank/src/main/webapp/WEB-INF/web.xml
@@ -27,9 +27,6 @@
         <auth-constraint>
             <role-name>no-users</role-name>
         </auth-constraint>
-        <user-data-constraint>
-            <transport-guarantee>NONE</transport-guarantee>
-        </user-data-constraint>
     </security-constraint>
     
     <security-role>
diff --git a/apps/mailreader/src/main/webapp/WEB-INF/web.xml b/apps/mailreader/src/main/webapp/WEB-INF/web.xml
index 9b35ec3ef..b01d86447 100644
--- a/apps/mailreader/src/main/webapp/WEB-INF/web.xml
+++ b/apps/mailreader/src/main/webapp/WEB-INF/web.xml
@@ -27,4 +27,21 @@
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
 
+    <!-- Restricts access to pure JSP files - access available only via Struts action -->
+    <security-constraint>
+        <display-name>No direct JSP access</display-name>
+        <web-resource-collection>
+            <web-resource-name>No-JSP</web-resource-name>
+            <url-pattern>*.jsp</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>no-users</role-name>
+        </auth-constraint>
+    </security-constraint>
+
+    <security-role>
+        <description>Don't assign users to this role</description>
+        <role-name>no-users</role-name>
+    </security-role>
+
 </web-app>
diff --git a/apps/portlet/src/main/webapp/WEB-INF/web.xml b/apps/portlet/src/main/webapp/WEB-INF/web.xml
index f42441989..d4a3c79ff 100644
--- a/apps/portlet/src/main/webapp/WEB-INF/web.xml
+++ b/apps/portlet/src/main/webapp/WEB-INF/web.xml
@@ -28,4 +28,21 @@
     	</listener-class>
     </listener>
 
+    <!-- Restricts access to pure JSP files - access available only via Struts action -->
+    <security-constraint>
+        <display-name>No direct JSP access</display-name>
+        <web-resource-collection>
+            <web-resource-name>No-JSP</web-resource-name>
+            <url-pattern>*.jsp</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>no-users</role-name>
+        </auth-constraint>
+    </security-constraint>
+
+    <security-role>
+        <description>Don't assign users to this role</description>
+        <role-name>no-users</role-name>
+    </security-role>
+
 </web-app>
diff --git a/apps/rest-showcase/src/main/webapp/WEB-INF/web.xml b/apps/rest-showcase/src/main/webapp/WEB-INF/web.xml
index d10c214cc..694c349c2 100644
--- a/apps/rest-showcase/src/main/webapp/WEB-INF/web.xml
+++ b/apps/rest-showcase/src/main/webapp/WEB-INF/web.xml
@@ -26,4 +26,21 @@
         <welcome-file>index.jsp</welcome-file>
     </welcome-file-list>
 
+    <!-- Restricts access to pure JSP files - access available only via Struts action -->
+    <security-constraint>
+        <display-name>No direct JSP access</display-name>
+        <web-resource-collection>
+            <web-resource-name>No-JSP</web-resource-name>
+            <url-pattern>*.jsp</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>no-users</role-name>
+        </auth-constraint>
+    </security-constraint>
+
+    <security-role>
+        <description>Don't assign users to this role</description>
+        <role-name>no-users</role-name>
+    </security-role>
+
 </web-app>
diff --git a/apps/showcase/src/main/webapp/WEB-INF/web.xml b/apps/showcase/src/main/webapp/WEB-INF/web.xml
index 62335a4af..f3b88e916 100644
--- a/apps/showcase/src/main/webapp/WEB-INF/web.xml
+++ b/apps/showcase/src/main/webapp/WEB-INF/web.xml
@@ -194,4 +194,21 @@
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
 
+    <!-- Restricts access to pure JSP files - access available only via Struts action -->
+    <security-constraint>
+        <display-name>No direct JSP access</display-name>
+        <web-resource-collection>
+            <web-resource-name>No-JSP</web-resource-name>
+            <url-pattern>*.jsp</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>no-users</role-name>
+        </auth-constraint>
+    </security-constraint>
+
+    <security-role>
+        <description>Don't assign users to this role</description>
+        <role-name>no-users</role-name>
+    </security-role>
+
 </web-app>