To enhance the security posture of our application environment

SonarQube Server / Community Build
1

Must-share information (formatted with Markdown):

  • V9.9.5
  • Windows Installer
  • Enhance the Security Posture of our application environment in compliance with Security Technical Implementation Guides (STIGs). Ensuring that error messages do not contain sensitive information PII that could reveal system or database structures.
  • To meet this requirement, I am seeking your assistance with the following:

Configuration Settings: Could you provide detailed instructions on how to configure the application to prevent detailed database error messages from being displayed to end users? Specifically, we need to ensure that any error messages shown through the web front end are generic and do not reveal sensitive information about the database or internal workings of the application.
2. Preventing Specific Error Dialogs: Are there specific settings or configurations available within your application that can prevent detailed database error dialogs from being presented to the end user through the web front end?

   3. Best Practices: Are there any recommended best practices or additional settings within your application that we should implement to further secure error message outputs?

   4. Verification: Could you provide any documentation or proof that these settings have been configured correctly and meet the specified STIG requirements? Ensuring that no sensitive information gets leaked in error messages is of utmost importance to us.

   5. Support: If there are any known limitations or challenges associated with these configurations, we would appreciate your guidance on how to address them.  

 Ensuring that our application adheres to these security guidelines is critical for us. Your prompt response and assistance in this matter will be greatly appreciated.
3

Hey there.

There is no specific setting to configure. Only users with Administer System or Administer permission on a project would possibly see a specific database error, as they only ever appear in the UI in the context of a background task, the details of which are only available to those users.

However, with all that said, SonarQube is an open-source application. The database structure is public, and you aren’t gaining much by restricting this access as it concerns to database security.