界: Encapsulation
封裝是要劃定清楚的界限。在網頁瀏覽器中，這可能意味著確保您的行動程式碼不會被其他行動程式碼濫用。在伺服器上，這可能意味著區分經過驗證的資料與未經驗證的資料、區分一個使用者的資料與另一個使用者的資料，或區分允許使用者查看的資料與不允許查看的資料。
ColdFusion Bad Practices: Leftover Debug Code
Abstract
<cfdump> 標籤會洩漏部署的 web 應用中的機密資訊。Explanation
使用程式碼來進行除錯或測試的目的而輸出變數的值是常見的，而該程式碼不應隨附在部署的應用程式中或保留啟動狀態。當此類型的除錯程式碼意外地留在應用程式中，應用程式可能會在無意間將其資訊洩漏給攻擊者。並不是所有的除錯指令都會洩漏敏感或隱私的資訊。不過，出現除錯指令經常表示已忽略附近的程式碼，且可能處在一種未維護的狀態。
在 ColdFusion 中，遺忘的除錯程式碼中最常見的示例是
在 ColdFusion 中，遺忘的除錯程式碼中最常見的示例是
<cfdump> 標籤。雖然在產品開發過程中允許使用 <cfdump>，但身為開發人員，對程式碼負責是開發網路應用程式的重要部分，所以應仔細考慮是否能夠使用每個 <cfdump> 標籤。References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 215
[2] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200
[3] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200
[4] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200
[5] Standards Mapping - FIPS200 SI
[6] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[7] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.3.4 Sensitive Private Data (L1 L2 L3), 14.3.2 Unintended Security Disclosure Requirements (L1 L2 L3)
[8] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration
[9] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[10] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[11] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[12] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[19] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)
desc.semantic.cfml.coldfusion_badpractices_leftover_debug_code