Development tools and frameworks usually have options to make debugging easier for developers, but these features should never be enabled for applications deployed in production.

Why is this an issue?

Debug instructions or error messages can leak detailed information about the system, such as the application’s path, file names, or stack traces. The rule flags configurations and API calls that enable debug features, including stack trace printing, verbose logging, debug mode flags, and remote debugging endpoints.

What is the potential impact?

Information disclosure

Attackers can exploit debug output to learn internal application details, file paths, stack traces, and configuration data that can be leveraged to craft further attacks.

Increased attack surface

Debug features may expose remote debugging endpoints, profiling APIs, or detailed error pages that significantly increase the attack surface of the application.

How to fix it in CakePHP

Do not enable debugging features on production servers or applications distributed to end users.

Code examples

Noncompliant code example

CakePHP 1.x, 2.x:

Cake\Core\Configure::write('debug', 1); // Noncompliant
Cake\Core\Configure::write('debug', 2); // Noncompliant
Cake\Core\Configure::write('debug', 3); // Noncompliant

CakePHP 3.0:

Cake\Core\Configure::config('debug', true); // Noncompliant

Compliant solution

CakePHP 1.2:

Cake\Core\Configure::write('debug', 0); // this is the production mode

CakePHP 3.0:

Cake\Core\Configure::config('debug', false); // "0" or "false" for CakePHP 3.x is suitable (production mode) to not leak sensitive data on the logs.

How to fix it in WordPress

Do not enable debugging features on production servers or applications distributed to end users.

Code examples

Noncompliant code example

define( 'WP_DEBUG', true ); // Noncompliant

Compliant solution

define( 'WP_DEBUG', false );

Resources

Standards