title: Are there any directory permission settings in Tomcat to prevent jsp running?
body: <p>For instanace, here is the directory structure (and the Tomcat appBase is /home/user/webapps/):</p>
  
  <pre><code>/home/user/webapps/index.jsp
  /home/user/webapps/file/
  /home/user/webapps/upload/
  </code></pre>
  
  <p>Is it possible to block Tomcat from running jsps in file/- and upload/-?</p>
  
  <p>For example, files have been uploaded to /file/ directory:</p>
  
  <pre><code>http://mysite.com/file/test.jsp (not OK, jsp won't be executed)
  http://mysite.com/file/test.png (OK)
  </code></pre>
  
  <p>I have checked and tried the catalina.policy and WEB-INF/web.xml security-constraint, but in vain.</p>
  
  <p>I have blocked the illegal file types in my upload servlet, but I have this question in mind as someone may upload jsp files by other means (like FTP).</p>
  
  <p>Thank you very much in advance.</p>