Question
A penetration tester reviews a SAST vulnerability scan report. The following lines of code have been reported as vulnerable:
```
Issue 40 of 126
Language: Java
Severity: Medium
Call:
try {
// ...
} catch (SomeException e) {
e.printStackTrace();
}
```
Which of the following is the best method to remediate this vulnerability?
- A. Implementing a logging framework Correct
- B. Removing the five code lines reported with issues
- C. Initiating a secure coding-awareness program with all the developers
- D. Documenting the vulnerability as a false positive
Explanation
Calling e.printStackTrace() writes the full stack trace to standard error, which can expose internal details to users or uncontrolled logs (information exposure through error messages). The fix is to route exceptions through a proper logging framework that records them securely at a controlled level and shows users only a generic message. Removing the lines would drop the exception handling altogether, an awareness program does not fix this code, and the finding is a real issue, not a false positive.
