While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
Extended Description
An attacker who finds these comments can map the application's structure and files, expose hidden parts of the site, and study the fragments of code to reverse engineer the application, which may help develop further attacks against the site.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Demonstrative Examples
Example 1
The following comment, embedded in a JSP, will be displayed in the
resulting HTML output.
(Bad Code)
Example Languages: HTML and JSP
<!-- FIXME: calling this with more than 30 args kills the JDBC
server -->
blog software leaks real username in HTML
comment.
Potential Mitigations
Remove comments which have sensitive information about the
design/implementation of the application. Some of the comments may be
exposed to the user and affect the security posture of the
application.
Description
