On 02/10/10 01:17 PM, emiddio-verizon wrote:
> in book core servlets and javaServer pages Vol 2 2nd edition -
>
> there is discussion in Tomcat of "invoker servlet",
>
> this servlet will accept URI of form
> http:/host:deployed-app/servlet/package.classname
>
> 2 questions:
>
> 1 -- does glassfish have one ? -- i think not.
It was removed several releases ago, for security reasons.
>
> 2 -- if glassfish did would there have to be info in the
> default-web.xml or some application specific web.xml ? i think yes.
It should never be declared in default-web.xml, because that would make
every deployed app vulnerable to the kind of attacks made possible by this
servlet. If your app really depended on the functionality provided by
this servlet,
it should declare it in its own web.xml.
Jan
>
> thanks again
>
> gary
>