MSC30-J. Do not exit abruptly from a finally block

If a finally clause is specified, irrespective of whether the try or catch block executes to completion or not, the finally block is executed.

Noncompliant Code Example

Here, the finally block completes abruptly since a return statement occurs within it. As a result, when the exception is thrown in method someException, it does not show up in the output. This is due to the abrupt termination of the finally block that suppresses any useful exception information displayed in the try block by overriding it with its own message. Note that even if the try block returns some value, the finally block is executed.

class SomeException extends Exception { 
  public SomeException(String s) { 
    super(s); 
  }
}

class TryFinally {
  private static void throwException() throws SomeException {
    throw new NullPointerException();
  }
            
  static private boolean doLogic() {
    try {
          throwException();
    } catch (SomeException se) { System.out.println("Exception thrown"); }
  
    finally {
              System.out.println("Uncaught Exception");
              return true;
    }
  }

  public static void main(String[] args) {
    doLogic();	
  }
}

Compliant Solution

This compliant solution removes the return statement from the finally block. Likewise, keywords like break,continue and throw should never be used within a finally block.

class SomeException extends Exception { 
  public SomeException(String s) { 
    super(s); 
  }
}

class TryFinally {
  private static void throwException() throws SomeException {
    throw new NullPointerException();
  }
            
  static private void doLogic() {
    try {
          throwException();
    } catch (SomeException se) { System.out.println("Exception thrown"); }
  
    finally {
              System.out.println("Uncaught Exception");
    }
  }

  public static void main(String[] args) {
    doLogic();	
  }
}

Risk Assessment

Exiting abruptly from a finally block may have unexpected results.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[JLS 05]] Section 14.20.2, Execution of try-catch-finally
[[Bloch 05]] Puzzle 36: Indecision