title: How to fix "reveal system data or debugging information by calling println()" by Fortify
body: <p>Our project uses Fortify to scan our codes. After Scanning the codes, there is an Audit problem since HttpServletResponse directly writes the error message.</p>
  
  <pre><code>response.getWriter().println(e.getLocalizedMessage());
  </code></pre>
  
  <p>The followings are the explain about this issue.</p>
  
  <blockquote>
    <p>Abstract:</p>
    
    <p>The function processNonPersistenceException() in Utility.java might
    reveal system data or debugging information by calling println() on
    line 86. The information revealed by println() could help an adversary
    form a plan of attack.</p>
    
    <p>Explanation:</p>
    
    <p>An external information leak occurs when system data or debugging
    information leaves the program to a remote machine via a socket or
    network connection.  External leaks can help an attacker by revealing
    specific data about operating systems, full pathnames, the existence
    of usernames, or locations of configuration files, and are more
    serious than internal information leaks which are more difficult for
    an attacker to access.</p>
    
    <p>In this case println() is called in Utility.java at line 86.</p>
  </blockquote>
  
  <p>And the recommendations are;</p>
  
  <blockquote>
    <p>Recommendations:</p>
    
    <p>Write error messages with security in mind. In production
    environments, turn off detailed error information in favor of brief
    messages. Restrict the generation and storage of detailed output that
    can help administrators and programmers diagnose problems. Be careful,
    debugging traces can sometimes appear in non-obvious places (embedded
    in comments in the HTML for an error page, for example).</p>
    
    <p>Even brief error messages that do not reveal stack traces or database
    dumps can potentially aid an attacker. For example, an "Access Denied"
    message can reveal that a file or user exists on the system. Due to
    this, it's advised to always keep information instead of sending it to
    a resource directly outside the program.</p>
  </blockquote>
  
  <p>I don't really know how to fix this issue. Do you have any suggestion? Many thanks.</p>
  
  <p>BR
  Alex</p>