According to the Java Language Specification \[[JLS 2005|AA. References#JLS 05]\], Section 11.2, "Compile-Time Checking of Exceptions,"

The unchecked exceptions classes are the class RuntimeException and its subclasses, and the class Error and its subclasses. All other exception classes are checked exception classes.

Unchecked exception classes such as Error and its subclasses are not subject to compile-time checking because it is tedious to account for all exceptional conditions and recovery is generally difficult. However, recovery is usually possible, or a graceful exit that logs the error is at least feasible.

Noncompliant Code Example

This noncompliant code example generates a StackOverflowError as a result of infinite recursion. It exhausts the available stack space and may result in denial of service.

public class StackOverflow {
  public static void main(String[] args) {
    infiniteRun();
    // ...
  }
    
  private static void infiniteRun() {
    infiniteRun();
  }
}

Compliant Solution

This compliant solution shows a try-catch block that can be used to capture java.lang.Error or java.lang.Throwable. A log entry can be made at this point and followed by attempts to free key system resources in the finally block.

public class StackOverflow {
  public static void main(String[] args) {
    try {
      infiniteRun();
    } catch(Throwable t) {
      // Forward to handler
    } finally {
      // Free cache, release resources
    }
    // ...
  }
    
  private static void infiniteRun() {
    infiniteRun();    
  }
}

Note that this solution catches Throwable in an attempt to handle the error and is an exception to guideline EXC14-J. Catch specific exceptions as opposed to the more general RuntimeException or Exception.

Risk Assessment

Allowing a system error to propagate out of a Java program may result in a denial-of-service attack.

Automated Detection

Automated detection is not feasible.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Other Languages

This guideline appears in the C++ Secure Coding Standard as ERR30-CPP. Try to recover gracefully from unexpected errors.

Bibliography

\[[JLS 2005|AA. References#JLS 05]\] [Section 11.2, Compile-Time Checking of Exceptions|http://java.sun.com/docs/books/jls/third_edition/html/exceptions.html#11.2]
\[[Kalinovsky 2004|AA. References#Kalinovsky 04]\] Chapter 16, Intercepting Control Flow: Intercepting System Errors

EXC07-J. Prevent exceptions while logging data      06. Exceptional Behavior (ERR)