Hi,
I use DWR 3.0 JavaScript lib. In direct call to *.dwr URL you get exception info, e.g.:
throw 'allowScriptTagRemoting is false.';
//#DWR-REPLY
if (window.dwr) dwr.engine.remote.handleBatchException({ name:'java.lang.IllegalArgumentException', message:'Failed to find parameter: scriptSessionId' });
else if (window.parent.dwr) window.parent.dwr.engine.remote.handleBatchException({ name:'java.lang.IllegalArgumentException', message:'Failed to find parameter: scriptSessionId' });
Is there a way to hide java.lang.IllegalArgumentException part? Some PCI compliance scanners assumes this as vulnerable?
I was thinking about some filter applied on response, but maybe there is something simpler?
Any ideas?