> If you're raising an exception deep in some internal code, provide as much detail as possible.
> If the error bubbles up to the user,
...then you have an information disclosure vulnerability! There's a really good reason why we don't bubble up deep exceptions to end users: Attackers can use that info to gain information about your back end that they can use to find worse vulnerabilities.
Put all the detail you want in your logs. Keep the end users out of it. They shouldn't be able to tell what line broke things.
Yeah things are a bit different with web apps. There users usually can't do anything with the info even if they had details, so internal logs is clearly the place. But my point still stands: you want detailed info in those logs, not just a lone "file not found" without anything else.
> If the error bubbles up to the user,
...then you have an information disclosure vulnerability! There's a really good reason why we don't bubble up deep exceptions to end users: Attackers can use that info to gain information about your back end that they can use to find worse vulnerabilities.
Put all the detail you want in your logs. Keep the end users out of it. They shouldn't be able to tell what line broke things.