[ZEPPELIN-2014] Jetty Directory Listing on app, assets, components, and scripts

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.6.2
• Fix Version/s: 0.7.3, 0.8.0
• Component/s: Core
• Labels: config security

Environment

RHEL

• Flags: Important
• Assignee: Viktor Boginskii
• Reporter: Ian Tyndall
• Created: 25/Jan/17 23:30
• Updated: 16/Aug/17 00:23
• Resolved: 04/Feb/17 00:17

Description

Security Issue, would not pass my institution's security scanners.
The Web directory list is made publicly accessible folders by default.
As a bandaid, I've added code in the daemon shell script to put index html files with a meta refresh in the affected directories.

It would be nice if this could be configured on the fly with other jetty config with this:
https://www.eclipse.org/jetty/documentation/9.3.x/override-web-xml.html

But, a nice hard coded fix would be great in the meantime!

Issue Links

• Blocked: ZEPPELIN-2864 Release 0.7.3
• links to: GitHub Pull Request #1962