JBaker213009 (Community Member) asked a question.
Resolving sensitive information issues (CWE-209 and CWE-201) on Android.
I have several CWE-209 and CWE-201 flaws coming up in my scans that I cannot seem to get rid of. I have made errors returned to the user generic, ensured all data sent out of the application is intended and caught exceptions thrown by libraries called and none of it seems to remove the flaw. Is there anything specific I should be checking for in code to remove these flaws or do I just need to mark it as false positive and move on?
.png){kind=logo}
Veracode Static Analysis will report CWE - 209 : Information Exposure Through an Error Message if we detect that a stack trace is being printed to an app output. If you are printing generic errors the flaw should be automatically closed, you may still have a code path where an error message is leaked. I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema