Adobe 38043740 Lockdown Guide - Page 79

Remove WSRP Servlet Mapping, 6.9 Disabling the CFFileServlet Mapping

Get Adobe 38043740 - ColdFusion Standard - Mac PDF manuals and user guides
UPC - 883919135168
View all Adobe 38043740 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 79 highlights

If you are not using the cfreport you can change the servlet mapping for *.cfr to point to the CFForbiddenServlet, this servlet will return 403 forbidden response if a cfr file is requested: CFCServlet *.cfr Change to: CFForbiddenServlet *.cfr Be sure to remove the .cfr mapping on the web server. 6.8 Remove WSRP Servlet Mapping The WSRP Servlets and Filters are used to support Web Services for Remote Portlets, a SOAP based API for serving portlets. If this feature is not used the web services Remove the WSRPFilter Servlet Mapping: WSRPProducer /WSRPProducer/* 6.9 Disabling the CFFileServlet Mapping The CFFileServlet is used to serve dynamically generated assets. It is used to support the following tags cfreport, cfpresentation, and cfimage (with action=captcha and action=writeToBrowser). If you are not using these features you may remove the servlet mapping: 79

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
79
If you are not using the cfreport you can change the servlet mapping for *.cfr to point to the
CFForbiddenServlet, this servlet will return 403 forbidden response if a cfr file is requested:
<servlet-mapping id="coldfusion_mapping_12">
<servlet-name>CFCServlet</servlet-name>
<url-pattern>*.cfr</url-pattern>
</servlet-mapping>
Change to:
<servlet-mapping id="coldfusion_mapping_12">
<servlet-name>CFForbiddenServlet</servlet-name>
<url-pattern>*.cfr</url-pattern>
</servlet-mapping>
Be sure to remove the .cfr mapping on the web server.
6.8 Remove WSRP Servlet Mapping
The WSRP Servlets and Filters are used to support Web Services for Remote Portlets, a SOAP based API for
serving portlets. If this feature is not used the web services
Remove the WSRPFilter Servlet Mapping:
<servlet-mapping>
<servlet-name>WSRPProducer</servlet-name>
<url-pattern>/WSRPProducer/*</url-pattern>
</servlet-mapping>
6.9 Disabling the CFFileServlet Mapping
The CFFileServlet is used to serve dynamically generated assets. It is used to support the following tags
cfreport, cfpresentation, and cfimage (with action=captcha and action=writeToBrowser). If you are not using
these features you may remove the servlet mapping: