Invocation of System.exit() terminates the Java Virtual Machine (JVM), consequently terminating all running programs and threads. This can result in denial-of-service (DoS) attacks. For example, a call to System.exit() that is embedded in Java Server Pages (JSP) code can cause a web server to terminate, preventing further service for users. Programs must prevent both inadvertent and malicious calls to System.exit(). Additionally, programs should perform necessary cleanup actions when forcibly terminated (for example, by using the Windows Task Manager, POSIX kill command, or other mechanisms).
...
This noncompliant code example uses System.exit() to forcefully shutdown shut down the JVM and terminate the running process. The program lacks a security manager; consequently, it lacks the capability to check whether the caller is permitted to invoke System.exit().
...
This implementation uses an internal flag to track whether the exit is permitted. The method setExitAllowed() sets this flag. The checkExit() method throws a SecurityException when the flag is unset (that is, false). Because this flag is not initially set, normal exception processing bypasses the initial call to System.exit(). The program catches the SecurityException and performs mandatory cleanup operations, including logging the exception. The System.exit() method is enabled only after cleanup is complete.
Exceptions
ERR09-J-EX0: It is permissible for a command-line utility to call System.exit(), for example, when the required number of arguments are not input [Bloch 2008], [ESA 2005].
Risk Assessment
Allowing unauthorized calls to System.exit() may lead to denial of service (DoS).
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
ERR09-J |
Low |
Unlikely |
Medium | P2 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| JAVA.DEBUG.CALL | Debug Call (Java) | ||||||
| Coverity | 7.5 | DC.CODING_STYLE | Implemented | ||||||
| Parasoft Jtest |
| CERT.ERR09.JVM CERT.ERR09.EXIT | Do not stop the JVM in a web component Do not call methods which terminates Java Virtual Machine | ||||||
| SonarQube |
| S1147 | Exit methods should not be called |
Related Guidelines
Android Implementation Details
On Android, System.exit() should not be used because it will terminate the virtual machine abruptly, ignoring the activity lifecycle life cycle, which may prevent proper garbage collection.
Bibliography
[API |
2014] |
Runtime, method
| |
Section 9.5, "The Finalize Method" | |
[ESA 2005] | Rule 78 |
, Restrict the use of the | |
Section 7.4, "JVM Shutdown" | |
Chapter 16, "Intercepting a Call to |
...
06. Exceptional Behavior (ERR) 07. Visibility and Atomicity (VNA)