Page History

Propagating the content of exceptions without performing explicit filtering is often associated with information leakage. An attacker may craft input parameters such that underlying structures and mechanisms may get exposed inadvertently. Information leakage can result from both the exception message text and the type of exception. For example, with FileNotFoundException, the message reveals the file system layout while the type conveys the absence of the file.

Noncompliant Code Example

...

import java.io.FileInputStream;
import java.io.FileNotFoundException;

class ExceptionExample {
  public static void main(String[] args) throws FileNotFoundException {
    FileInputStream dis = new FileInputStream("c:\\" + args[1]);
  }
}

Compliant Solution

Information leakage can result from both the exception message text and the type of exception. With FileNotFoundException, the message reveals the file system layout while the type conveys the absence of the file. The same To overcome the problem, the exception must be caught while taking special care to sanitize the message before propagating it to the caller. In cases where the exception type itself can reveal too much, consider throwing a different exception (with a different message) altogether.

...