CS.INFORMATION_EXPOSURE.ATTR

Potential security information exposure

This checker flags potentially unintended logging or printing to the console of data fields specifically marked with the attribute [SecurityCritical] or [SecuritySafeCritical]. This checker will flag all instances of calls to the most widely used logging methods that report messages at error or critical error levels.

The checker is parametrizable. You can change the list of logging methods recognized by the checker by modifying the XML file that contains the checker description, located in the <install>\plugin\csharp directory.

Vulnerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
   namespace Program
   {
       class Program
       {
           [SecurityCritical]
           static int x = 10;
           static void Main(string[] args)
           {
               Console.WriteLine(" Critical X " + x);
          }
      }
  }

Klocwork reports a CS.INFORMATION_EXPOSURE.ATTR defect at line 11, indicating that data ‘x’ marked with the [SecurityCritical] attribute is printed to the console and can potentially result in the unintended exposure of sensitive data..

Vulnerable code example 2

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
   using System.Security;
   
   namespace Program
   {
       class Program
       {
           [SecuritySafeCritical]
           static int y = 10;
           static void Main(string[] args)
          {
              logger.Error($"y = {y}");
          }
  
          public static log4net.ILog logger; // initialized elsewhere
      }
  }

Klocwork reports a CS.INFORMATION_EXPOSURE.ATTR defect at line 11, indicating that data marked with the [SecuritySafeCritical] attribute is passed to a logging function that can potentially result in the unintended exposure of critical data.

CS.INFORMATION_EXPOSURE.ATTR

Potential security information exposure

Vulnerable code example 1

Vulnerable code example 2

Related checkers

External guidance

Security training