If a finally clause is specified, irrespective of whether the try or catch block executes to completion or not, the finally block is executed. Consequently statements that cause the finally block to terminate abruptly may can mask of any thrown exceptions. Consequently, keywords like return, break, continue and throw should never be used within a finally block.

Noncompliant Code Example

Here, the finally block completes abruptly because a return statement occurs within it. As a result, when the IllegalStateException is thrown, it does not propagate all the way up through the call stack. This is because of the abrupt termination of the finally block that suppresses any useful exception information from being displayed by overriding the exception thrown in the try block with its own message. Note that even if the try block returns some value, the finally block is executed.

class TryFinally {              
  private static boolean doLogic() {
    try {
      throw new IllegalStateException(); 
    } 
    finally {
      System.out.println("Uncaught Exception");
      return true;
    }
  }

  public static void main(String[] args) {
    doLogic();	
  }
}

Compliant Solution

This compliant solution removes the return statement from the finally block. Any return statements must occur after this block. If this is adopted, the compiler throws an error as the return statement is unreachable because of the explicit, unavoidable throwing of IllegalStateException. If the exception is thrown conditionally, the return statement can be used without any compilation errors.

class TryFinally {         
  private static boolean doLogic() {
    try {
      throw new IllegalStateException(); 
    }  
    finally {
      System.out.println("Caught Exception");
    }
    // any return statements must go here
  }

  public static void main(String[] args) {
    doLogic();	
  }
}

Risk Assessment

Exiting abruptly from a finally block may cause the masking of thrown exceptions.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] [Section 14.20.2, Execution of try-catch-finally|http://java.sun.com/docs/books/jls/third_edition/html/statements.html#14.20.2]
\[[Bloch 05|AA. Java References#Bloch 05]\] Puzzle 36: Indecision
\[[Chess 07|AA. Java References#Chess 07]\] 8.2 Managing Exceptions, "The Vanishing Exception"
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 705|http://cwe.mitre.org/data/definitions/705.html] "Incorrect Control Flow Scoping", [CWE ID 584|http://cwe.mitre.org/data/definitions/584.html] "Return Inside Finally Block"

EXC07-J. Restore prior object state on method failure      11. Exceptional Behavior (EXC)      EXC31-J. Handle checked exceptions that can be thrown within a finally block