Description

Detects PHP configurations that enable display of detailed error messages in production environments. When error display is enabled via ini_set(), sensitive information like stack traces, database credentials, or internal paths could be exposed to attackers through error messages.

Detection Strategy

• Identifies direct calls to PHP's ini_set() function

• Verifies the ini_set() call is not within a conditional statement (if/switch) that might restrict it to development environments

• Examines the arguments passed to ini_set() to check if they enable error display settings

• Reports a vulnerability when error display is explicitly enabled outside of proper environment checks

Vulnerable code example

<?php
// Dangerous: Enables error display which can expose sensitive information
ini_set("display_errors", 1);

// Also vulnerable: Using variables but same security impact
$config_key = "display_errors";
$config_val = "ON";
ini_set($config_key, $config_val);

✅ Secure code example

<?php
// Safe: Disable error display in production
ini_set("display_errors", 0);

// Use error logging instead of displaying errors
ini_set("log_errors", 1);
error_reporting(E_ALL);
ini_set("error_log", "/var/log/php-errors.log");...