CVE-2020-5274: Generation of Error Message Containing Sensitive Information (CWE-209)
value: In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 5.4
Published: 2020-03-30T20:15Z
Repository: https://github.com/symfony/symfony
Language: PHP
Files changed: src/Symfony/Component/ErrorHandler/Debug.php, src/Symfony/Component/ErrorHandler/ErrorHandler.php
Commit date: 2020-01-26 15:27:56 -0500
Commit message: Added debug argument to decide if debug page should be shown or not

Diff: diff --git a/src/Symfony/Component/ErrorHandler/Debug.php b/src/Symfony/Component/ErrorHandler/Debug.php
index f95334e01ab..50d1789f092 100644
--- a/src/Symfony/Component/ErrorHandler/Debug.php
+++ b/src/Symfony/Component/ErrorHandler/Debug.php
@@ -29,8 +29,8 @@ class Debug
             ini_set('display_errors', 1);
         }
 
         DebugClassLoader::enable();
 
-        return ErrorHandler::register(new ErrorHandler(new BufferingLogger()));
+        return ErrorHandler::register(new ErrorHandler(new BufferingLogger(), true));
     }
 }
diff --git a/src/Symfony/Component/ErrorHandler/ErrorHandler.php b/src/Symfony/Component/ErrorHandler/ErrorHandler.php
index f4dcfb10942..b44611ec566 100644
--- a/src/Symfony/Component/ErrorHandler/ErrorHandler.php
+++ b/src/Symfony/Component/ErrorHandler/ErrorHandler.php
@@ -90,10 +90,11 @@ class ErrorHandler
     private $scopedErrors = 0x1FFF; // E_ALL - E_DEPRECATED - E_USER_DEPRECATED
     private $tracedErrors = 0x77FB; // E_ALL - E_STRICT - E_PARSE
     private $screamedErrors = 0x55; // E_ERROR + E_CORE_ERROR + E_COMPILE_ERROR + E_PARSE
     private $loggedErrors = 0;
     private $traceReflector;
+    private $debug;
 
     private $isRecursive = 0;
     private $isRoot = false;
     private $exceptionHandler;
     private $bootstrappingLogger;
@@ -178,18 +179,19 @@ class ErrorHandler
         } finally {
             restore_error_handler();
         }
     }
 
-    public function __construct(BufferingLogger $bootstrappingLogger = null)
+    public function __construct(BufferingLogger $bootstrappingLogger = null, bool $debug = false)
     {
         if ($bootstrappingLogger) {
             $this->bootstrappingLogger = $bootstrappingLogger;
             $this->setDefaultLogger($bootstrappingLogger);
         }
         $this->traceReflector = new \ReflectionProperty('Exception', 'trace');
         $this->traceReflector->setAccessible(true);
+        $this->debug = $debug;
     }
 
     /**
      * Sets a logger to non assigned errors levels.
      *
@@ -695,11 +697,11 @@ class ErrorHandler
      * As this method is mainly called during boot where nothing is yet available,
      * the output is always either HTML or CLI depending where PHP runs.
      */
     private function renderException(\Throwable $exception): void
     {
-        $renderer = \in_array(\PHP_SAPI, ['cli', 'phpdbg'], true) ? new CliErrorRenderer() : new HtmlErrorRenderer(0 !== $this->scopedErrors);
+        $renderer = \in_array(\PHP_SAPI, ['cli', 'phpdbg'], true) ? new CliErrorRenderer() : new HtmlErrorRenderer($this->debug);
 
         $exception = $renderer->render($exception);
 
         if (!headers_sent()) {
             http_response_code($exception->getStatusCode());

Vulnerable code:         return ErrorHandler::register(new ErrorHandler(new BufferingLogger()));
    public function __construct(BufferingLogger $bootstrappingLogger = null)
        $renderer = \in_array(\PHP_SAPI, ['cli', 'phpdbg'], true) ? new CliErrorRenderer() : new HtmlErrorRenderer(0 !== $this->scopedErrors);
Fixed code:         return ErrorHandler::register(new ErrorHandler(new BufferingLogger(), true));
    private $debug;
    public function __construct(BufferingLogger $bootstrappingLogger = null, bool $debug = false)
        $this->debug = $debug;
        $renderer = \in_array(\PHP_SAPI, ['cli', 'phpdbg'], true) ? new CliErrorRenderer() : new HtmlErrorRenderer($this->debug);