(CodeQL) Fixed finding: "Prevent information leak of stack trace details to HTTP responses"

[pixeebot-test]

Remediation

This change fixes "Prevent information leak of stack trace details to HTTP responses" (id = stack-trace-exposure) identified by CodeQL.

Details

This change prevents stack trace information from reaching the HTTP response, which could leak code internals to an attacker and aid in further profiling and attacks.

Have you ever seen an error page and thought, "Wow, I certainly shouldn't be seeing all these code details?" That's this problem.

Switching to a safe signature that doesn't leak anything is easy and the changes look something like this:

  try {
    httpResponse.write(output);
  } catch (Exception e) {
-   response.sendError(401, e.getMessage());
+   response.sendError(401);
  }

More reading

• https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/
• https://cwe.mitre.org/data/definitions/209.html
• https://cwe.mitre.org/data/definitions/497.html

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: codeql:java/stack-trace-exposure