VNX-756: Framework traceback page served instead of a custom error page

Reports Python web applications configured to answer unhandled exceptions with the framework's debug traceback page: FastAPI/Starlette debug=True, Tornado debug/serve_traceback, Bottle debug, CherryPy show_tracebacks, Sanic/Quart run(debug=True) and web.py debugerror.

Field	Value
Rule ID	`VNX-756`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-756
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`missing-custom-error` `debug-mode` `python` `cwe-756`
Source	`internal/sast/rules/vnx-756.rego`

Overview

VNX-756 maps to CWE-756: Missing Custom Error Page. It reports configuration that sends the framework’s debug error page (stack trace, source lines, local variables) to the client in place of a custom error page:

FastAPI and Starlette: FastAPI(debug=True), Starlette(debug=True)
Tornado: debug=True or serve_traceback=True, as an Application keyword or a settings entry
Bottle: bottle.debug(True), debug(True) and run(..., debug=True)
CherryPy: 'request.show_tracebacks': True
Sanic and Quart: app.run(..., debug=True)
web.py: web.config.debug = True and app.internalerror = web.debugerror

For every framework except FastAPI and Starlette, the file must import that framework.

What Gets Flagged

app = FastAPI(
    title="Orders",
    debug=True,          # reported on the FastAPI( line
)
cherrypy.config.update({"request.show_tracebacks": True})   # FLAGGED

Not reported: debug read from an environment variable, a setting or a flag, debug=False, run(debug=True) on other objects, test code and comments. VNX-PY-008 covers the Flask debugger and VNX-PY-006 covers Django DEBUG = True.

Remediation

Turn debug off in deployed configuration, and read it from the environment with False as the default.
Register a generic error handler that logs the exception on the server and returns a plain error page.

References

CWE-756: Missing Custom Error Page

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-756
// nosec vnx-756

Or record an ignore rule: vulnetix ignore add --rule vnx-756 --reason "...". See Suppressing findings.