Never use {{return}}, {{break}}, {{continue}}, or {{throw}} statements within a {{finally}} block. When program execution enters a {{try}} block that has a {{finally}} block, the {{finally}} block always executes, regardless of whether the {{try}} block (or any associated {{catch}} blocks) executes to completion. Statements that cause the {{finally}} block to terminate abruptly also cause the {{try}} block to terminate abruptly and consequently mask any exception thrown from the {{try}} or {{catch}} blocks \[[JLS 2005|http://java.sun.com/docs/books/jls/third_edition/html/statements.html#14.20.2]\]. |
In this noncompliant code example, the finally
block completes abruptly because of a return
statement in the block.
class TryFinally { private static boolean doLogic() { try { throw new IllegalStateException(); } finally { System.out.println("logic done"); return true; } } } |
The IllegalStateException
is suppressed by the abrupt termination of the finally
block caused by the return
statement.
This compliant solution removes the return
statement from the finally
block.
class TryFinally { private static boolean doLogic() { try { throw new IllegalStateException(); } finally { System.out.println("logic done"); } // Any return statements must go here; applicable only when exception is thrown conditionally } } |
ERRO4-EX0: Control flow statements whose destination is within the finally
block are perfectly acceptable.
For instance, the following code does not violate this rule, because the break statement exits the while loop, but not the finally block.
class TryFinally { private static boolean doLogic() { try { throw new IllegalStateException(); } finally { int c; try { while ((c = input.read()) != -1) { if (c > 128) { break; } } } catch (IOException x) { // forward to handler } System.out.println("logic done"); } // Any return statements must go here; applicable only when exception is thrown conditionally } } |
Exiting abruptly from a finally
block masks any exceptions thrown inside the associated try
and catch
blocks.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
ERR04-J |
low |
probable |
medium |
P4 |
L3 |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
CWE ID 459, "Incomplete Cleanup" |
|
|
CWE ID 584, "Return Inside Finally Block" |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e753a5a6-ff82-4e64-b393-9102b6fc229e"><ac:plain-text-body><![CDATA[ |
[[Bloch 2005 |
AA. Bibliography#Bloch 05]] |
Puzzle 36: Indecision |
]]></ac:plain-text-body></ac:structured-macro> |
|
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d9f0334e-114c-449a-9846-03cfa318d5d6"><ac:plain-text-body><![CDATA[ |
[[Chess 2007 |
AA. Bibliography#Chess 07]] |
8.2 Managing Exceptions, "The Vanishing Exception" |
]]></ac:plain-text-body></ac:structured-macro> |
|
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0fb9800d-8eeb-4ed5-a9f1-d5430184d591"><ac:plain-text-body><![CDATA[ |
[[JLS 2005 |
AA. Bibliography#JLS 05]] |
[§14.20.2, Execution of try-catch-finally |
http://java.sun.com/docs/books/jls/third_edition/html/statements.html#14.20.2] |
]]></ac:plain-text-body></ac:structured-macro> |
06. Exceptional Behavior (ERR)