J2EE Misconfiguration: Excessive Servlet Mappings

ABSTRACT

多個 URL 模式映射到單個 Servlet，這種情況通常表明體系結構較差或不標準。

EXPLANATION

映射到單個 Servlet 的多個 URL 模式可視為 Servlet 執行過多函數的標志。



例 1：在以下示例中，五個 URL 模式映射至單個 Servlet。

<servlet>
<servlet-class>com.class.MyServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
<servlet-name>MyServlet</servlet-name>
<url-pattern>/myservlet</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>MyServlet</servlet-name>
<url-pattern>/helloworld*</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>MyServlet</servlet-name>
<url-pattern>/servlet*</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>MyServlet</servlet-name>
<url-pattern>/mservlet*</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>MyServlet</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>

REFERENCES

[1] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 398

[2] Sun Microsystems, Inc. Java Servlet Specification 2.4