Development tools and frameworks usually have options to make debugging easier for developers, but these features should never be enabled for applications deployed in production.

Why is this an issue?

Debug instructions or error messages can leak detailed information about the system, such as the application’s path, file names, or stack traces. The rule flags configurations and API calls that enable debug features, including stack trace printing, verbose logging, debug mode flags, and remote debugging endpoints.

What is the potential impact?

Information disclosure

Attackers can exploit debug output to learn internal application details, file paths, stack traces, and configuration data that can be leveraged to craft further attacks.

Increased attack surface

Debug features may expose remote debugging endpoints, profiling APIs, or detailed error pages that significantly increase the attack surface of the application.

How to fix it in Java SE

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

Throwable.printStackTrace(...) prints a Throwable and its stack trace to System.Err (by default) which is not easily parseable and can expose sensitive information:

Noncompliant code example

try {
  /* ... */
} catch(Exception e) {
  e.printStackTrace(); // Noncompliant
}

Compliant solution

Loggers should be used (instead of printStackTrace) to print throwables:

try {
  /* ... */
} catch(Exception e) {
  LOGGER.log("context", e);
}

How to fix it in Spring

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

EnableWebSecurity annotation for SpringFramework with debug to true enables debugging support:

Noncompliant code example

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

@Configuration
@EnableWebSecurity(debug = true) // Noncompliant
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  // ...
}

Compliant solution

EnableWebSecurity annotation for SpringFramework with debug to false disables debugging support:

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

@Configuration
@EnableWebSecurity(debug = false)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  // ...
}

How to fix it in Android WebView

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

WebView.setWebContentsDebuggingEnabled(true) for Android enables debugging support:

Noncompliant code example

import android.webkit.WebView;

WebView.setWebContentsDebuggingEnabled(true); // Noncompliant
WebView.getFactory().getStatics().setWebContentsDebuggingEnabled(true); // Noncompliant

Compliant solution

WebView.setWebContentsDebuggingEnabled(false) for Android disables debugging support:

import android.webkit.WebView;

WebView.setWebContentsDebuggingEnabled(false);
WebView.getFactory().getStatics().setWebContentsDebuggingEnabled(false);

Resources

Standards