If a finally
clause is specified, irrespective of whether the try or catch block executes to completion or not, the finally
block is executed. Consequently statements that abruptly exit from the finally
block may cause related catch
blocks to not get executed. Thus, keywords like return
, break
, continue
and throw
should never be used within a finally
block.
Noncompliant Code Example
Here, the finally
block completes abruptly since a return statement occurs within it. As a result, when the exception is thrown in method someException
, it does not show up in the output. This is due to the abrupt termination of the finally
block that suppresses any useful exception information from being displayed in the try
block by overriding it with its own message. Note that even if the try
block returns some value, the finally
block is executed.
Note that MullPointerException
is a RuntimeException
, and thus does not need to occur in a throws
declaration. The throwException()
function never actually throws SomeException
, although it claims to via its throws
declaration.
class SomeException extends Exception { public SomeException(String s) { super(s); } } class TryFinally { private static void throwException() throws SomeException { throw new NullPointerException(); } static private boolean doLogic() { try { throwException(); } catch (SomeException se) { System.out.println("Exception thrown"); } finally { System.out.println("Uncaught Exception"); return true; } } public static void main(String[] args) { doLogic(); } }
Compliant Solution
This compliant solution removes the return statement from the finally
block.
class SomeException extends Exception { public SomeException(String s) { super(s); } } class TryFinally { private static void throwException() throws SomeException { throw new NullPointerException(); } static private void doLogic() { try { throwException(); } catch (SomeException se) { System.out.println("Exception thrown"); } finally { System.out.println("Uncaught Exception"); } return true; } public static void main(String[] args) { doLogic(); } }
Risk Assessment
Exiting abruptly from a finally block may have unexpected results.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
EXC30-J |
low |
unlikely |
medium |
P2 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[JLS 05]] Section 14.20.2, Execution of try-catch-finally
[[Bloch 05]] Puzzle 36: Indecision
[[Chess 07]] 8.2 Managing Exceptions, "The Vanishing Exception"
EXC04-J. Prevent against inadvertent calls to System.exit() or forced shutdown 10. Exceptional Behavior (EXC) EXC31-J. Handle checked exceptions that can be thrown within a finally block