First, whenever I see this I point it out because I've seen people get hung up on it. The directory WEB-INF must always be spelled with upper case letters.
A directory named 'web-inf' has no special meaning in
Java web application.
This happens enough that it is the textbook example used in:
http://faq.javaranch.com/java/AvoidRedHerrings If you're saying here, that a.jsp is being allowed direct access to a browser (and the directory is really named "WEB-INF") I would tell you that you are wrong.
web-inf/a.jsp-->some servlet(b.class)
Nothing under WEB-INF is directly available to the web.