Page History

...

While this exception is less likely to leak useful information than previous noncompliant code examples, it still reveals that the specified file cannot be read. More specifically, the program reacts differently to nonexistent file paths than it does to valid ones, and an attacker can still infer sensitive information about the file system from this program's behavior. Failure to restrict user input leaves the system vulnerable to a brute force attack in which the attacker discovers valid file names by issuing queries that collectively cover the space of possible file names. Filenames File names that cause the program to return the sanitized exception indicate nonexistent files, filenames file names that don't, reveal existing files.

...

...