界: Encapsulation
封装即绘制强边界。在 Web 浏览器中，这可能意味着确保您的移动代码不会被其他移动代码滥用。在服务器上，这可能意味着区分已验证数据和未验证数据、区分一个用户的数据和另一个用户的数据，或者区分允许用户查看的数据和不允许用户查看的数据。
ColdFusion Bad Practices: Leftover Debug Code
Abstract
在部署的 Web 应用程序中，
<cfdump> 标签可能会泄漏敏感信息。Explanation
在实践中，人们往往为了达到调试和测试代码的目的而输出某些变量的值，同时附带的还有一些本不应提供或保留在正式部署的应用系统中的代码。当这种类型的调试代码意外地留在应用程序中，应用程序可能会在无意间将其泄漏给攻击者。但并不是所有的调试指令都会泄漏敏感或私密信息。然而，调试指令的出现通常意味着附近的代码已被忽略，而且可能处在一种不受维护的状态。
在 ColdFusion 中，遗忘调试代码最常见的一例是遗忘
在 ColdFusion 中，遗忘调试代码最常见的一例是遗忘
<cfdump> 标签。虽然在软件开发过程中允许使用 <cfdump> 标签，但是作为开发者，对代码负责是 Web 应用程序开发的重要部分，所以应该仔细考虑是否能够使用每一个 <cfdump> 标签。References
[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1.0
[2] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3.0
[3] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1
[4] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal
[5] Standards Mapping - Common Weakness Enumeration CWE ID 215
[6] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200
[7] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200
[8] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200
[9] Standards Mapping - FIPS200 SI
[10] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[11] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration
[12] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.3.4 Sensitive Private Data (L1 L2 L3), 14.3.2 Unintended Security Disclosure Requirements (L1 L2 L3)
[13] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[14] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[16] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[23] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)
desc.semantic.cfml.coldfusion_badpractices_leftover_debug_code