SecurityInnovation/TMContentReview — Issue #58: Do Not Disclose Exception Details to the Client
Author: SergeTruth
Created: 2011-11-07 22:23:29+00:00
State: open

The example under "Dynamically Generated Error Messages" should relate to the description of the problem. They currently are not in sync.

The problem highlighted in the example code is Log Forging.

The data being output to the browser is a static string not dynamic input. Also the example to be an anti-pattern highlighting path tampering or direct object references.

It might be a good idea to introduce a random delay time into the error page to mitigate against Padding Oracle attacks.

The code example in "Problem Example" does not look to fit with the description.

The example code in the Solution needs to catch java.lang.Throwable to ensure that all exceptions are caught in the try/catch block.