Development tools and frameworks usually have options to make debugging easier for developers, but these features should never be enabled for applications deployed in production.

Why is this an issue?

Debug instructions or error messages can leak detailed information about the system, such as the application’s path, file names, or stack traces. The rule flags configurations and API calls that enable debug features, including stack trace printing, verbose logging, debug mode flags, and remote debugging endpoints.

What is the potential impact?

Information disclosure

Attackers can exploit debug output to learn internal application details, file paths, stack traces, and configuration data that can be leveraged to craft further attacks.

Increased attack surface

Debug features may expose remote debugging endpoints, profiling APIs, or detailed error pages that significantly increase the attack surface of the application.

How to fix it in Django

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

Noncompliant code example

django.conf.settings.configure is called with debug settings enabled in the Django settings:

from django.conf import settings

settings.configure(DEBUG=True)  # Noncompliant
settings.configure(DEBUG_PROPAGATE_EXCEPTIONS=True)  # Noncompliant

def custom_config(config):
    settings.configure(default_settings=config, DEBUG=True)  # Noncompliant

Inside settings.py or global_settings.py, which are the default configuration files for a Django application:

DEBUG = True  # Noncompliant
DEBUG_PROPAGATE_EXCEPTIONS = True  # Noncompliant

Compliant solution

from django.conf import settings

settings.configure(DEBUG=False)
settings.configure(DEBUG_PROPAGATE_EXCEPTIONS=False)

def custom_config(config):
    settings.configure(default_settings=config, DEBUG=False)

DEBUG = False
DEBUG_PROPAGATE_EXCEPTIONS = False

How to fix it in Flask

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

Noncompliant code example

from flask import Flask

app = Flask()
app.debug = True  # Noncompliant
app.run(debug=True)  # Noncompliant

The following code defines a GraphQL endpoint with GraphiQL enabled. While this might be a useful configuration during development, it should never be enabled for applications deployed in production:

from flask import Flask
from graphql_server.flask import GraphQLView

app = Flask(__name__)

app.add_url_rule(
    '/graphql',
    view_func=GraphQLView.as_view(
        'graphql',
        schema=schema,
        graphiql=True # Noncompliant
    )
)

Compliant solution

from flask import Flask

app = Flask()
app.debug = False
app.run(debug=False)

from flask import Flask
from graphql_server.flask import GraphQLView

app = Flask(__name__)

app.add_url_rule(
    '/graphql',
    view_func=GraphQLView.as_view(
        'graphql',
        schema=schema
    )
)

Resources

Standards