Exposure of sensitive system information to an unauthorized control sphere
ID |
scala.unsafe.scala_unsafe_rule_sensitivedataexposure |
Severity |
low |
Remediation Complexity |
hard |
Remediation Risk |
high |
Remediation Effort |
medium |
Resource |
Unsafe |
Language |
Scala |
Description
Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Pages that provide different responses based on the validity of the data can lead to Information Leakage; specifically when data deemed confidential is being revealed as a result of the web application’s design.
Rationale
Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Pages that provide different responses based on the validity of the data can lead to Information Leakage; specifically when data deemed confidential is being revealed as a result of the web application’s design.
The following code illustrates a vulnerable pattern detected by this rule:
class SettingsController @Inject() (cc: ControllerComponents) extends AbstractController(cc) {
def show(configuration: Configuration, key: String) = Action {
val setting = configuration.underlying.getString(key)
// VULNERABLE: Exposure of sensitive system information to an unauthorized control sphere
Ok("Setting: " + setting)
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A01 : Broken Access Control.