== Why is this an issue?

The ``++trace()++`` function outputs debug statements, which can be read by anyone with a debug version of the Flash player. Because sensitive information could easily be exposed in this manner, ``++trace()++`` should never appear in production code.


=== Noncompliant code example

[source,flex]
----
    var val:Number = doCalculation();
    trace("Calculation result: " + val);  // Noncompliant
----


=== Compliant solution

[source,flex]
----
    var val:Number = doCalculation();
----


== Resources

* OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]


ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Remove this use of the "trace" function.


'''
== Comments And Links
(visible only on this page)

=== on 25 Aug 2014, 07:43:49 Freddy Mallet wrote:
\[~ann.campbell.2], my 2 cents: I would activate this rule by default

endif::env-github,rspecator-view[]
