Detailed Exceptions Enabled

Description

The `consider_all_requests_local` setting is enabled, which can expose sensitive system or application information to end users, potentially aiding attackers in crafting further attacks.

Examples

Insecure Code

config.consider_all_requests_local = true

Secure Code

config.consider_all_requests_local = false

Remediation

Set `config.consider_all_requests_local` to `false` in production environments.

Rule Details

Field	Value
ID	CODE-0530
Category	InsecureConfig
Severity	MEDIUM
CWE	CWE-209
Confidence	HIGH
Impact	HIGH
Likelihood	MEDIUM
Exploitability	EASY
Tags	error handling, sensitive data exposure
OWASP	A3:2017-Sensitive Data Exposure, A05:2021-Security Misconfiguration

References

• https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/detailed-exceptions.yaml

---