1243
Phase: Operation
Protect log files against unauthorized read/write.
Phase: Implementation
Adjust configurations appropriately when software is transitioned from a debug state to
production.
Demonstrative Examples
Example 1:
In the following code snippet, a user's full name and credit card number are written to a log file.
Example Language: Java (Bad)
logger.info("Username: " + usernme + ", CCN: " + ccn);
Example 2:
This code stores location information about the current user:
Example Language: Java (Bad)
locationClient = new LocationClient(this, this, this);
locationClient.connect();
currentUser.setLocation(locationClient.getLastLocation());
...
catch (Exception e) {
AlertDialog.Builder builder = new AlertDialog.Builder(this);
builder.setMessage("Sorry, this application has experienced an error.");
AlertDialog alert = builder.create();
alert.show();
Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString());
}
When the application encounters an exception it will write the user object to the log. Because the
user object contains location information, the user's location is also written to the log.
Example 3:
In the example below, the method getUserBankAccount retrieves a bank account object from
a database using the supplied username and account number to query the database. If an
SQLException is raised when querying the database, an error message is created and output to a
log file.
Example Language: Java (Bad)
public BankAccount getUserBankAccount(String username, String accountNumber) {
BankAccount userAccount = null;
String query = null;
try {
if (isAuthorizedUser(username)) {
query = "SELECT * FROM accounts WHERE owner = "
+ username + " AND accountID = " + accountNumber;
DatabaseManager dbManager = new DatabaseManager();
Connection conn = dbManager.getConnection();
Statement stmt = conn.createStatement();
ResultSet queryResult = stmt.executeQuery(query);
userAccount = (BankAccount)queryResult.getObject(accountNumber);
}
} catch (SQLException ex) {
String logMessage = "Unable to retrieve account information from database,\nquery: " + query;
Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);
}
return userAccount;
CWE Version 4.14
CWE-535: Exposure of Information Through Shell Error Message
CWE-535: Exposure of Information Through Shell Error Message