ERR04-J. Do not exit abruptly from a finally block

When program execution enters a try block that has a finally block, the finally block always executes, regardless of whether the try block (or any associated catch blocks) execute to completion. Statements that cause the finally block to terminate abruptly also cause the try block to terminate abruptly, and consequently mask any exception thrown from the try or catch blocks (JLS 2005).

Never use return, break, continue or throw statements within a finally block.

Noncompliant Code Example

In this noncompliant code example, the finally block completes abruptly due to a return statement.

class TryFinally {              
  private static boolean doLogic() {
    try {
      throw new IllegalStateException(); 
    } finally {
      System.out.println("Uncaught Exception");
      return true;
    }
  }

  public static void main(String[] args) {
    doLogic();	
  }
}

Consequently, when the IllegalStateException is thrown, it does not propagate all the way up through the call stack. Rather, the abrupt termination of the finally block suppresses the IllegalStateException because it the return statement becomes the final cause of abrupt termination of the try block.

Compliant Solution

This compliant solution removes the return statement from the finally block.

class TryFinally {         
  private static boolean doLogic() {
    try {
      throw new IllegalStateException(); 
    } finally {
      System.out.println("Caught Exception");
    }
    // Any return statements must go here; applicable only when exception is thrown conditionally
  }

  public static void main(String[] args) {
    doLogic();	
  }
}

If this example had a return statement outside the finally block, the compiler would report an error because the return statement would be unreachable due to the unconditional throwing of IllegalStateException. If the exception were thrown conditionally, the return statement could be used without compilation error.

Risk Assessment

Exiting abruptly from a finally block masks any exceptions thrown inside the associated try and catch blocks.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[Bloch 2005]] Puzzle 36: Indecision
[[Chess 2007]] 8.2 Managing Exceptions, "The Vanishing Exception"
[[JLS 2005]] Section 14.20.2, Execution of try-catch-finally[[MITRE 2009]] CWE ID 705 "Incorrect Control Flow Scoping", CWE ID 584 "Return Inside Finally Block"

VOID ERR03-J. Use a logging API to log critical security exceptions      06. Exceptional Behavior (ERR)