Page History

...

import java.io.FileInputStream;
import java.io.FileNotFoundException;

class ExceptionExample {
  public static void main(String[] args) throws FileNotFoundException {
    FileInputStream disfis = new FileInputStream("c:\\" + args[0]);
  }
}

...

To overcome the problem, the exception must be caught while taking special care to sanitize the message before propagating it to the caller. In cases where the exception type itself can reveal too much, consider throwing a different exception altogether (with a different message) altogether, or possibly a higher level exception, referred to as exception translation). The MyExceptionReporter class described in EXC05-J. Use a class dedicated to reporting exceptions is a good choice, as exemplified in this compliant solution. Notice how Throwable is caught instead of specific exceptions. This is a departure from commonly suggested best practices, but is critical in cases where runtime exceptions or errors can reveal sensitive information.

import java.io.FileInputStream;
import java.io.FileNotFoundException;

class NewException extends Exception {
  //common exception for abstraction purposes	
  public NewException() {
    super("Error!");
  }
}

class ExceptionExample {
  public static void main(String[] args) throws NewException {
    try {
      FileInputStream disfis = new FileInputStream("c:\\" + args[0]);
    }
    catch(FileNotFoundExceptionThrowable fnft) { 
      throw new NewException(MyExceptionReporter.report(t); // Sanitize
    } //sanitized message
  }
}

While following this guideline, make sure that security exceptions such as java.security.AccessControlException and java.lang.SecurityException are not swallowed or masked in the process. This can lead to far more pernicious effects such as missed security event log entries. The MyExceptionReporter class prescribes a method to deal with this condition.

Risk Assessment

Exceptions may inadvertently reveal sensitive information unless care is taken to limit the information displayed as the result of an exception.

...