MSkidmore454594 (Community Member) asked a question.
Can the Catch block of a Try-Catch block be a source of a CWE ID 209 Flaw?
I'm getting a CWE ID 209 Flaw that the stack trace shows is in the try scope of a try-catch block - no mention of the corresponding catch block. There is no exception message within the try block but there is in a method in the corresponding catch block. Specifically, in the try block, my code calls Send(emailObject) on an SMTP object (SMTP.Send(arg)) and the catch block calls HandleUndeliverables(ex, emailObject). Could the catch block be the source of my CWE ID 209 flaw even though there's no mention of it in the stack trace (path)?
.png){kind=logo}
Hi @MSkidmore454594 (Community Member),
Veracode Static Analysis will report CWE 209 (Generation of Error Message Containing Sensitive Information) if it can detect that information from an exception (e.g. a stack trace) is being sent out of an application, presuming that this output may be displayed to a user. Many times error messages and especially stack traces are quite useful to attackers as they reveal implementation details or information that is useful in exploiting a vulnerability. As an example, database error messages can make SQL Injection significantly easier.
We would always recommend returning generic error messages to the user. Adjust the amount of information that the user sees to reflect what they need to know. The details, which can be useful for troubleshooting, should instead be preserved in the application log.
In your example, our static engine seems to think that the `emailObject` contains data that can be traced back to an exception. If this is reported on the `Send(emailObject)` and is part of a `try` block, the exception from which data may flow into `emailObject` might be from a different `catch` block.
I would recommend investigating all code paths into `emailObject` to see if, under any circumstances, there might be exception data flowing into it. If you need assistance in identifying how exception data may flow into `emailObject` please schedule a consultation. The following Knowledge article describes how to do this: https://community.veracode.com/s/article/How-to-schedule-a-consultation-call .
Thank you,
Florian Walter