OWASP
V14.3 Verbiage Paragraph is odd
I've always thought the wording for the paragraph in section V14.3 doesn't read very well. Might I purpose the following language instead?
Configurations for production should be hardened to protect against common attacks. Disabling debug consoles helps to prevent known Cross-site Scripting (XSS) and Remote File Inclusion (RFI) attacks. It also helps to eliminate trivial information discovery "vulnerabilities" that are the unwelcome hallmark of many penetration testing reports. Many of these issues are rarely rated as a significant risk, but they can be chained together with other vulnerabilities, resulting in a higher risk value.
Hi,
as we change requirements at the moment, texts in paragraph are not updated. This is something we need to recheck when changes with requirements are kind of done and before releasing.
The V14.3 section now got title "Unintended Information Leakage" and the point there should be that for attackers (and search engines) can be available information, which is not to be intended to be public and which is outside of application access and authorization flow control.
But in big picture, we can open an issue for each section or clean-up entire document from text and start collecting just "points to cover" there. From one leaders meeting - we should use as short texts as possible.
We are going to massively reduce section text as @elarlang stated so I am politely closing this out. Please re-open if you think this was premature.
