2 Replies Latest reply on Sep 5, 2013 3:19 PM by ctomc

    Disabling JSP: jsp-configuration disable="true" broken?

    rgm

      I'd like to disable JSP in my JBoss 7.1.1 final application server.  I have read the documentation for the jsp-configuration element and tried using the following XML snippet in my "standalone.xml":

       

               <subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
                   <configuration>
                       <jsp-configuration disabled="true"/>
                   </configuration>
                   <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
                   <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
            ...
      

       

      Then, using jboss-cli.sh, I can examine the web resource properties:

      [disconnected /] connect
      /subsystem=web:read-resource(recursive=true):read-resource
      {
         "outcome" => "success",
         "result" => {
         "default-virtual-server" => "default-host",
         "instance-id" => undefined,
         "native" => "false",
         "configuration" => {
         "container" => {
         "mime-mapping" => undefined,
         "welcome-file" => undefined
        },
      ...
         "jsp-configuration" => {
         "check-interval" => 0,
         "development" => false,
         "disabled" => "true",
         "display-source-fragment" => true,
      ...
      

       

      With this configuration set, test JSP files are still getting compiled and run.  I would expect to instead see the source code of the JSP file in my web browser (served as a static resource), if JSP features have been disabled properly.

       

      Notice that the "disabled" attribute in the CLI output has a string value of "true" -- surrounded by quotes.  It's not a boolean as in other jsp-configuration properties.

      Is this a bug?   How can I set this to a boolean true value?  Even if I did that, would that even disable whatever servlet is mapped to *.jsp?