should NOT respond to GET /bin/querybuilder.feed.css with 200

I am trying to block these:

should NOT respond to GET /bin/querybuilder.feed.css with 200

should NOT respond to GET /bin/querybuilder.json.servlet;%0aa.css with 200

should NOT respond to GET /crx/de/index.jsp;%0aa.css with 200

should NOT respond to GET /crx/explorer/index.jsp;%0aa.css with 200

so  does this work?

1. { /type "deny"  /url"/bin/querybuilder.feed.css" }
2. { /type "deny"  /url"/bin/querybuilder.json.servlet;%0aa.css" }
3. { /type "deny"  /url"/crx/de/index.jsp;%0aa.css" }
4. { /type "deny"  /url"/crx/explorer/index.jsp;%0aa.css" }

for #3 and #4,   /crx/de and   /crx/explorer can be blocked at AEM itself otherwise for dispatcher you should deny all and allow only relevant paths. 

You should have /0001 { /type "deny" /glob "*" }  to take care of "/crx" and other paths

for #1 and #2, use "selectors" and "extension"

/006 {

  /type "deny"

  /path "/bin/*"  or /path "/bin/querybuilder*"

  /selectors '(feed|servlet|json)'

  /extension '(css)'

  }

refer -  Dispatcher- publisher System/console is giving 500 error.

Do you mean that this doesn't work for CRX?

1. { /type "deny"  /url"/crx/de/index.jsp;%0aa.css" }
2. { /type "deny"  /url"/crx/explorer/index.jsp;%0aa.css" }

It would work fine but in ideal scenario (per best practices), you are supposed to deny all paths and allow only specific paths. When you deny all paths, /crx is covered under that.

HTH

How can I do that in AEM itself?

How it can be done using /path, /selectors, /extension?

Thanks

check Security Checklist

Check if the CRX development bundles are present

These development OSGi bundles should be uninstalled on both author and publish productive systems before making them accessible.

• Adobe CRXDE Support (com.adobe.granite.crxde-support)
• Adobe Granite CRX Explorer (com.adobe.granite.crx-explorer)
• Adobe Granite CRXDE Lite (com.adobe.granite.crxde-lite)