CWE-210 通过自主产生的错误消息导致的信息暴露 类漏洞列表 2

The following code uses custom configuration files for each user in the application. It checks to see if the file exists on the system before attempting to open and use the file. If the configuration file does not exist, then an error is generated, and the application exits.

$uname = GetUserInput("username"); # avoid CWE-22, CWE-78, others. if ($uname !~ /^\w+$/) { ExitError("Bad hacker!") ; } $filename = "/home/myprog/config/" . $uname . ".txt"; if (!(-e $filename)) { ExitError("Error: $filename does not exist"); }