Possible information leakage detected.

• Rule ID: java_lang_information_leakage
• Languages: java
• Source: information_leakage.yml

Description

Printing a stack trace to the default output is risky because it may contain sensitive information such as the technical details of your application or environment (which in turn could expose your application to path traversal attacks, for example), or worse, user-specific data.

Remediations

❌ Avoid printing the full stack trace

✅ Less is more! Only log the minimum required details in error messages

Resources

• Web Application Security Consortium: Information Leakage

Associated CWE

• CWE-209: Generation of Error Message Containing Sensitive Information

OWASP Top 10

• A04:2021 - Insecure Design

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_lang_information_leakage

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_lang_information_leakage