tags:

views:

447

answers:

0

Hi,

I use DWR 3.0 JavaScript lib. In direct call to *.dwr URL you get exception info, e.g.:

throw 'allowScriptTagRemoting is false.';
//#DWR-REPLY
if (window.dwr) dwr.engine.remote.handleBatchException({ name:'java.lang.IllegalArgumentException', message:'Failed to find parameter: scriptSessionId' });
else if (window.parent.dwr) window.parent.dwr.engine.remote.handleBatchException({ name:'java.lang.IllegalArgumentException', message:'Failed to find parameter: scriptSessionId' });

Is there a way to hide java.lang.IllegalArgumentException part? Some PCI compliance scanners assumes this as vulnerable?

I was thinking about some filter applied on response, but maybe there is something simpler?

Any ideas?