Default Filter rules on AEM Cloud opens way too much

[nhirrle]

aem-project-archetype/src/main/archetype/dispatcher.cloud/src/conf.dispatcher.d/filters/default_filters.any

Line 25 in ea27d77

/0011 { /type "allow" /method "GET" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|png|svg|swf|ttf|woff|woff2)' }

A servlet may be open on publish and should not.

Example: /bin/some-servlet.json.servlet.json/something.js may respond if /bin wasn't blocked afterwards.

Possible solution:

/0011 { /type "allow" /method "GET" /extension '(css|eot|gif|ico|jpeg|jpg|js|gif|png|svg|swf|ttf|woff|woff2)' /suffix "" /method '(GET|HEAD)' }

block at least suffixes.

Please doublecheck why this rule is even required, it is NOT present in AMS