Stack trace written to an HTTP response
ID |
scala.unsafe.scala_unsafe_rule_informationexposure |
Severity |
high |
Remediation Complexity |
hard |
Remediation Risk |
high |
Remediation Effort |
medium |
Resource |
Unsafe |
Language |
Scala |
Description
A stack trace of a caught exception is sent to the HTTP response. It discloses file paths, frameworks and code structure to whoever sent the request, which helps an attacker launch a more focused attack. Log the exception server-side and return a generic error message to the client instead.
Rationale
A stack trace of a caught exception is sent to the HTTP response. It discloses file paths, frameworks and code structure to whoever sent the request, which helps an attacker launch a more focused attack. Log the exception server-side and return a generic error message to the client instead.
The response is the servlet response writer / stream (response.getWriter, response.getOutputStream) or a Play
result (InternalServerError(…), Ok(…)…). Printing the stack trace to stderr / stdout
(e.printStackTrace(), e.printStackTrace(out)) reaches the log, which is the recommended remediation, and is not
reported.
The following code illustrates a vulnerable pattern detected by this rule:
class ObjectsController(cc: ControllerComponents) extends AbstractController(cc) {
def show(id: String) = Action {
try {
Ok(resolve(id))
} catch {
case e: Exception =>
// VULNERABLE: stack trace returned to the caller
InternalServerError(e.getStackTrace.mkString("\n"))
}
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A01 : Broken Access Control.