sus.botdocs

QA finding

The page shows a server error, a stack trace or nothing at all

QA Error Severity: High

Part of the audit Error pages and server messages. Finding id: qa.errorTextInPage.

What it costs you

The visitor gets an error instead of the content.

What to do

Fix the failure behind the message, and make the site show a plain error page and write details to a log instead.

What it checks

  • Server error text shown to visitors
  • Technical error details shown on page
  • Page has no content

How to fix it

Fill the page or return an error status

  1. Open the page and view its source. An empty body usually means the template depends on data that is missing.
  2. Restore the data or the content.
  3. If nothing belongs at this address, make it answer 404 or 410.

How to check: Reload the page: it shows its content, or the status line says 404 or 410.

Fix the error and stop printing details

  1. Open the page and copy the full message for the developer; it names the failing file or query.
  2. Fix the cause.
  3. Turn off the display of errors in the production configuration of the application and log them on the server instead.

How to check: Reload the page: it shows its content and no error text. Recheck it with this rule.

A real case

Patreon ran the Werkzeug debugger in production, so any visitor who forced an error got the debugging tool. Attackers used it, and the stolen data, holding 2.3 million unique email addresses, was published.

Source: Security Affairs, 3 October 2015

Thresholds

Thresholds for The page shows a server error, a stack trace or nothing at all
NameDefaultMeaning
stack_trace_pattern(?m)Traceback \(most recent call last\)|Stack trace:\s*#0|Fatal error: .+ on line \d+|Exception in thread "|^\s*at [\w.$<>]+\([\w.]+:\d+\)|\bat \S+ in \S+:line \d+Text that only appears when a program prints its own failure: Python, PHP, Java and .NET traces. These are the English messages the programs print by default; add patterns for a localised runtime.
server_error_pattern(?i)Warning: .+ on line \d+|Notice: Undefined |SQLSTATE\[|You have an error in your SQL syntax|ORA-\d{5}|Error establishing a database connection|Internal Server Error|502 Bad Gateway|503 Service UnavailableMessages of web servers, databases and PHP that should not reach a visitor. The default is English; add the wording of a localised server or CMS.