<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Software developers often add stack traces to error messages, as a

debugging aid. Whenever that error message occurs for an end user, the

developer can use the stack trace to help identify how to fix the

problem. In particular, stack traces can tell the developer more about

the sequence of events that led to a failure, as opposed to merely the

final state of the software when the error occurred.</p>

<p>Unfortunately, the same information can be useful to an attacker.

The sequence of class names in a stack trace can reveal the structure

of the application as well as any internal components it relies on.</p>

</overview>

<recommendation>

<p>Send the user a more generic error message that reveals less information.

Either suppress the stack trace entirely, or log it only on the server.</p>

</recommendation>

<example>

<p>In the following example, a panic is handled in two different

ways. In the first version, labeled BAD, a detailed stack trace is

written to a user-facing HTTP response object, which may disclose

sensitive information. In the second version, the error message is

logged only on the server. That way, the developers can still access

and use the error log, but remote users will not see the

information.</p>

<sample src="StackTraceExposure.go" />

</example>

<references>

<li>OWASP: <a href="https://owasp.org/www-community/Improper_Error_Handling">Improper Error Handling</a>.</li>

</references>

</qhelp>