How to Restrict access to web-inf folder from accessing outside without using security-constraint

Question

My Web application structure is

>     App1.war
>     -WEB-INF
>        - web.xml
>        - classes
>        - config etc.

and due to some other functionality implementation, we have added a filter

<filter-mapping>
    <filter-name>CustomerFilter</filter-name>
    <url-pattern>/customer/pages/*</url-pattern>
</filter-mapping>

And the filter class CustomerFilter.java

  public void doFilter(ServletRequest re, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        String requestURI = ((HttpServletRequest)re).getRequestURI();
        if (requestURI.endsWith(".action")) {
            chain.doFilter(request, response);
        }
        else {
            request.getRequestDispatcher(
                    requestURI.replace(config.getServletContext().getContextPath() + "/customer/pages", ""))
                    .forward(request, response);
        }
    }

due to this change, I can directly access the web.xml via URL yourserver/App1/customer/pages/WEB-INF/web.xml and it's a security vulnerability, so I added a security-constraint to solve this leakage. My question is do we have any other ways to handle this efficiently? or what is the other solutions for Directory traversal. ex:

<security-constraint>
  <display-name>SecurityConstraintForDirA</display-name>
  <web-resource-collection>
    <web-resource-name>DirAResources</web-resource-name>
    <url-pattern>customer/pages/WEB-INF/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>adm</role-name>
  </auth-constraint>  
</security-constraint>

Keep in mind my application is a struts-based old web application.