CVE-2014-8115 (XML, published 2015-02-20T16:59Z)
Description: value: The default authorization constrains in KIE Workbench 6.0.x allows remote authenticated users to read or write to arbitrary files, bypass intended access restrictions, and possibly have other unspecified impact via unknown vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/droolsjbpm/kie-wb-distributions
Files changed:
kie-drools-wb/kie-drools-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
kie-drools-wb/kie-drools-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
kie-drools-wb/kie-drools-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
kie-drools-wb/kie-drools-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
kie-drools-wb/kie-drools-wb-webapp/src/main/webapp/WEB-INF/web.xml
kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-exec-server.xml
kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-ui-server.xml
kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-exec-server.xml
kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-ui-server.xml
kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-exec-server.xml
kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-ui-server.xml
kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
kie-wb/kie-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
kie-wb/kie-wb-webapp/src/main/webapp/WEB-INF/web.xml
Commit message: BZ(1169544,1169556,1169557,1169559,1169560,1169545,1169566,1169565,1169563,1169562): improvements on security related to file access and servlet restrictions (by role)


Vulnerable code:
    <url-pattern>/customeditors </url-pattern>
    <security-constraint>
        <web-resource-collection>
          <web-resource-name>formModeler</web-resource-name>
          <url-pattern>/formModeler/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>admin</role-name>
          <role-name>analyst</role-name>
          <role-name>developer</role-name>
          <role-name>user</role-name>
          <role-name>manager</role-name>
        </auth-constraint>
    </security-constraint>
      around the  business processes and their performance, business indicators, and other
  
 
  </filter-mapping> 
   

Fixed code:
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <url-pattern>/customeditors</url-pattern>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>formModeler</web-resource-name>
      <url-pattern>/formModeler/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
      <role-name>user</role-name>
      <role-name>manager</role-name>
    </auth-constraint>
  </security-constraint>
      around the business processes and their performance, business indicators, and other


  </filter-mapping>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>