Just add this config to your web.xml
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>io.undertow.servlet.handlers.DefaultServlet</servlet-class>
<init-param>
<param-name>allowed-extensions</param-name>
<param-value>js, css, png, jpg, gif, html, htm, txt, pdf, jpeg, xml, zip</param-value>
</init-param>
<init-param>
<param-name>disallowed-extensions</param-name>
<param-value>class, jar, war</param-value>
</init-param>
</servlet>
and modify allowed / disallowed extensions anyway you want