Revealing details about an application's implementation is a security issue because it provides attackers with information they can use to further their attacks. Details such as class, file or path names reveal information to the attacker that can be used to attempt other attacks. For example, revealing path information in a message to the web interface may reveal the location of the web server's directory hierarchy. An attacker could use this information in a path injection attack. In general, the amount of information revealed to the web interface should be minimized, and design details in particular should not be revealed.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Design information leakage can be prevented by removing information from messages sent to the web interface for the application. General users of the application are likely not going to need such information, and attackers can gain information that can be used for further attacks. A common case of disclosure of design information occurs in Java exception-handling. Exception information is useful during programming, but dangerous after release. Be very careful of displaying or sending exception information, and make sure users never see such information. All stack traces and debug information should be stored in server logs in places where attackers cannot read it.

Example 1

15     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
16         String name = req.getParameter("userName");
17         File file = new File(System.getProperty("web.root"), name + ".dat");
18         try {
19             FileOutputStream str = new FileOutputStream(file);
20             // ...
21             str.close();
22         } catch (IOException e) {
23             throw new ServletException("Cannot open file " + file + ":" + e.getMessage());
24         }
25     }

SV.IL.DEV is reported for line 23: 'name' is initialized with a value of an HTTP request parameter and might be tainted (line 16). This value is used to create 'file' on line 17. If an exception is thrown on line 19, 'file' would be wrapped into ServletException, thus revelaing the value of an http request parameter to the web interface. Design information leakage can reveal important clues to attackers.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.