Error Handling Security Reference
Error Handling Security Reference
Overview
Improper error handling can lead to information disclosure, denial of service, or security bypasses. This includes verbose error messages exposing internals, fail-open patterns that skip security checks on errors, and unhandled exceptions that crash services or leave systems in insecure states.
Information Disclosure
Stack Traces in Responses
# VULNERABLE: Stack trace exposed to users
@app.errorhandler(Exception)
def handle_error(e):
return f"Error: {traceback.format_exc()}", 500
# VULNERABLE: Detailed exception info
@app.route('/api/user/<id>')
def get_user(id):
try:
return User.query.get(id).to_dict()
except Exception as e:
return jsonify({
'error': str(e),
'type': type(e).__name__,
'args': e.args
}), 500
Secure Error Handling
# SAFE: Generic messages, detailed logging
import logging
logger = logging.getLogger(__name__)
@app.errorhandler(Exception)
def handle_error(e):
# Log full details server-side
logger.error(f"Unhandled exception: {e}", exc_info=True)
# Return generic message to client
return jsonify({'error': 'An internal error occurred'}), 500
# SAFE: Custom exceptions with safe messages
class UserNotFoundError(Exception):
pass
@app.route('/api/user/<id>')
def get_user(id):
try:
user = User.query.get(id)
if not user:
raise UserNotFoundError()
return user.to_dict()
except UserNotFoundError:
return jsonify({'error': 'User not found'}), 404
except Exception:
logger.exception("Error fetching user")
return jsonify({'error': 'Internal error'}), 500
Fail-Open Patterns
Authentication Bypass on Error
# VULNERABLE: Fail-open authentication
def authenticate(token):
try:
user = verify_token(token)
return user
except Exception:
return None # Returns None, might be treated as valid
# VULNERABLE: Exception allows bypass
def check_permission(user, resource):
try:
return permission_service.check(user, resource)
except ServiceUnavailable:
return True # DANGEROUS: Allows access on service failure
# VULNERABLE: Default to authorized on error
@app.route('/admin')
def admin():
try:
if not is_admin(current_user):
abort(403)
except Exception:
pass # Silently continues to admin page
return render_admin_panel()
Secure Fail-Closed Patterns
# SAFE: Fail-closed authentication
def authenticate(token):
try:
user = verify_token(token)
if user is None:
raise AuthenticationError("Invalid token")
return user
except Exception as e:
logger.error(f"Auth error: {e}")
raise AuthenticationError("Authentication failed")
# SAFE: Deny on service unavailable
def check_permission(user, resource):
try:
return permission_service.check(user, resource)
except ServiceUnavailable:
logger.error("Permission service unavailable")
return False # Deny access when unable to verify
# SAFE: Explicit denial on error
@app.route('/admin')
def admin():
try:
if not is_admin(current_user):
abort(403)
except Exception as e:
logger.error(f"Admin check failed: {e}")
abort(500) # Don't proceed on error
return render_admin_panel()
Exception Swallowing
Dangerous Patterns
# VULNERABLE: Silent exception swallowing
try:
validate_input(user_input)
except:
pass # Validation skipped entirely
# VULNERABLE: Catch-all hides security issues
try:
result = dangerous_operation(user_data)
except Exception:
result = default_value # May hide injection attempts
# VULNERABLE: Empty except block
try:
decrypt_sensitive_data(data)
except:
pass # Continues with encrypted/invalid data
Secure Exception Handling
# SAFE: Handle specific exceptions
try:
validate_input(user_input)
except ValidationError as e:
logger.warning(f"Validation failed: {e}")
return jsonify({'error': 'Invalid input'}), 400
except Exception as e:
logger.error(f"Unexpected validation error: {e}")
return jsonify({'error': 'Validation error'}), 500
# SAFE: Never silently swallow security-critical exceptions
try:
result = dangerous_operation(user_data)
except SecurityException as e:
logger.error(f"Security exception: {e}")
raise # Re-raise security exceptions
except ValueError as e:
logger.warning(f"Invalid data: {e}")
result = None
Differential Error Messages
User Enumeration via Errors
# VULNERABLE: Different messages reveal user existence
@app.route('/login', methods=['POST'])
def login():
user = User.query.filter_by(email=email).first()
if not user:
return jsonify({'error': 'User not found'}), 401 # Reveals user doesn't exist
if not check_password(password, user.password):
return jsonify({'error': 'Wrong password'}), 401 # Reveals user exists
return create_session(user)
# VULNERABLE: Timing difference reveals user existence
def login(email, password):
user = User.query.filter_by(email=email).first()
if not user:
return False # Fast return
return check_password(password, user.password) # Slow hash check
Secure Consistent Errors
# SAFE: Consistent error messages
@app.route('/login', methods=['POST'])
def login():
user = User.query.filter_by(email=email).first()
if not user or not check_password(password, user.password):
return jsonify({'error': 'Invalid credentials'}), 401 # Same message
return create_session(user)
# SAFE: Constant-time comparison with dummy hash
DUMMY_HASH = generate_password_hash('dummy')
def login(email, password):
user = User.query.filter_by(email=email).first()
if user:
valid = check_password(password, user.password)
else:
check_password(password, DUMMY_HASH) # Constant time even if user not found
valid = False
return valid
Resource Exhaustion via Errors
Uncontrolled Exception Logging
# VULNERABLE: Attacker can fill logs
@app.route('/api/data')
def get_data():
try:
return process_data(request.json)
except Exception as e:
# Logs entire request body - attacker sends huge payloads
logger.error(f"Error processing: {request.json}")
return jsonify({'error': 'Error'}), 500
Secure Logging
# SAFE: Limit logged data
@app.route('/api/data')
def get_data():
try:
return process_data(request.json)
except Exception as e:
# Log limited info, not full payload
logger.error(f"Error processing request from {request.remote_addr}")
return jsonify({'error': 'Error'}), 500
Unhandled Async Exceptions
Dangerous Patterns
// VULNERABLE: Unhandled promise rejection
async function processUser(userId) {
const user = await fetchUser(userId); // No catch
return user;
}
// VULNERABLE: Missing error handler
app.get('/api/data', async (req, res) => {
const data = await fetchData(); // Unhandled rejection crashes server
res.json(data);
});
Secure Async Handling
// SAFE: Always handle async errors
async function processUser(userId) {
try {
const user = await fetchUser(userId);
return user;
} catch (error) {
logger.error('Failed to fetch user', { userId, error });
throw new UserFetchError('Unable to fetch user');
}
}
// SAFE: Express async wrapper
const asyncHandler = (fn) => (req, res, next) => {
Promise.resolve(fn(req, res, next)).catch(next);
};
app.get('/api/data', asyncHandler(async (req, res) => {
const data = await fetchData();
res.json(data);
}));
// Global handler for unhandled rejections
process.on('unhandledRejection', (reason, promise) => {
logger.error('Unhandled Rejection', { reason });
// Don't exit - handle gracefully
});
Error-Based SQL Injection Indicators
Verbose Database Errors
# VULNERABLE: Database errors exposed
@app.route('/api/search')
def search():
try:
results = db.execute(f"SELECT * FROM items WHERE name = '{query}'")
return jsonify(results)
except Exception as e:
return jsonify({'error': str(e)}), 500
# Exposes: "syntax error at or near 'OR'" - reveals SQL injection possibility
Secure Database Error Handling
# SAFE: Generic database errors
@app.route('/api/search')
def search():
try:
results = db.execute("SELECT * FROM items WHERE name = %s", (query,))
return jsonify(results)
except DatabaseError as e:
logger.error(f"Database error: {e}")
return jsonify({'error': 'Search failed'}), 500
Cleanup on Error
Resource Leaks
# VULNERABLE: Resource not cleaned up on error
def process_file(filename):
f = open(filename)
data = f.read()
process(data) # If this raises, file handle leaks
f.close()
# VULNERABLE: Connection not returned to pool
def query_db():
conn = pool.get_connection()
result = conn.execute(query) # If this raises, connection leaks
pool.return_connection(conn)
return result
Secure Resource Management
# SAFE: Context managers ensure cleanup
def process_file(filename):
with open(filename) as f:
data = f.read()
process(data) # File closed even on exception
# SAFE: Try-finally for cleanup
def query_db():
conn = pool.get_connection()
try:
result = conn.execute(query)
return result
finally:
pool.return_connection(conn) # Always returns connection
Grep Patterns for Detection
# Bare except clauses
grep -rn "except:" --include="*.py" | grep -v "except Exception"
# Empty exception handlers
grep -rn "except.*:\s*$" -A1 --include="*.py" | grep "pass"
# Stack traces in responses
grep -rn "traceback\|format_exc\|exc_info" --include="*.py" | grep -v "logger\|logging"
# Fail-open patterns
grep -rn "except.*:\s*$" -A2 --include="*.py" | grep "return True\|return None"
# Detailed error messages
grep -rn "str(e)\|str(err)\|e\.args\|e\.message" --include="*.py" | grep "return\|jsonify\|response"
# Differential error messages
grep -rn "not found\|does not exist\|invalid password\|wrong password" --include="*.py"
# Unhandled async
grep -rn "await.*[^;]$" --include="*.js" --include="*.ts" | grep -v "try\|catch"
Testing Checklist
- No stack traces in production error responses
- All security checks fail-closed (deny on error)
- No empty except/catch blocks for security-critical code
- Consistent error messages for auth (no user enumeration)
- Async operations have error handlers
- Resources cleaned up on error (files, connections)
- Error logging doesn't include full user input
- Database errors don't expose query structure
- Rate limiting on error-generating endpoints