Pensar - auto fix for Sensitive Information Exposure Through Error Traceback

[pensarapp]

Type	Identifier	Message	Severity	Link
Application	CWE-209	The code prints the full traceback when an exception occurs (line 16). This may inadvertently expose sensitive internal system information or file paths which can aid an attacker in exploiting the system. While this pattern is useful for debugging, in a production environment, it may leak details that should be protected. It is advisable to log such information securely and provide a more generic error message to the end user.	medium	Link

The vulnerability (CWE-209: Information Exposure Through an Error Message) occurs because the code prints the full traceback information to the console when an exception occurs. This exposes sensitive internal system details such as file paths, method names, and stack traces that could help attackers exploit the system.

Original vulnerable code:

print(f"Error starting service: traceback: {traceback.format_exc()}")

The fix makes these changes:

1. Adds the standard Python logging module to securely capture error details
2. Configures logging to record the full exception traceback (via exc_info=True)
3. Creates a development/production mode toggle using the DEBUG environment variable
4. Only displays the full traceback in development mode (when DEBUG=true)
5. Shows a generic error message in production environments
6. Applies consistent error handling in both exception handlers

This approach addresses the security vulnerability while preserving debugging capabilities. The detailed error information is still available through logs (which can be secured and accessed by authorized personnel), and developers can still access full tracebacks during development by setting the DEBUG environment variable.

Note: The patch imports two standard Python modules (logging and os) which are part of the core library and don't create external dependencies.

[restack-app]

No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews.