542
Resultant :
Applicable Platforms
Language : PHP (Prevalence = Often)
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Potential Mitigations
Phase: System Configuration
Configure the application's environment in a way that prevents errors from being generated. For
example, in PHP, disable display_errors.
Phase: Implementation
Phase: Build and Compilation
Strategy = Compilation or Build Hardening
Debugging information should not make its way into a production release.
Phase: Implementation
Phase: Build and Compilation
Strategy = Environment Hardening
Debugging information should not make its way into a production release.
Phase: Implementation
Handle exceptions internally and do not display errors containing potentially sensitive information
to a user. Create default error pages if necessary.
Phase: Implementation
The best way to prevent this weakness during implementation is to avoid any bugs that could
trigger the external error message. This typically happens when the program encounters fatal
errors, such as a divide-by-zero. You will not always be able to control the use of error pages,
and you might not be using a language that handles exceptions.
Demonstrative Examples
Example 1:
The following servlet code does not catch runtime exceptions, meaning that if such an exception
were to occur, the container may display potentially dangerous information (such as a full stack
trace).
Example Language: Java (Bad)
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
String username = request.getParameter("username");
// May cause unchecked NullPointerException.
if (username.length() < 10) {
...
}
}
Example 2:
In the following Java example the class InputFileRead enables an input file to be read using a
FileReader object. In the constructor of this class a default input file path is set to some directory
CWE Version 4.14
CWE-211: Externally-Generated Error Message Containing Sensitive Information
CWE-211: Externally-Generated Error Message Containing Sensitive Information