Methods must not throw RuntimeException
, Exception
, or Exception
Throwable
. Handling these exceptions requires catching RuntimeException
, which is disallowed by rule ERR14ERR08-J. Do not catch NullPointerException or any of its ancestors. Moreover, throwing a RuntimeException
can lead to subtle errors; for example, a caller cannot examine the exception to determine why it was thrown and consequently cannot attempt recovery.
...
The isCapitalized()
method in this noncompliant code example accepts a string and returns true when it the string consists of a capital letter followed by lowercase letters. The method also throws a RuntimeException
when passed a null string argument.
Code Block | ||
---|---|---|
| ||
boolean isCapitalized(String s) {
if (s == null) {
throw new RuntimeException("Null String");
}
if (s.equals("")) {
return true;
}
String first = s.substring(0, 1);
String rest = s.substring(1);
return (first.equals(first.toUpperCase()) &&
rest.equals(rest.toLowerCase()));
}
|
A calling method must also violate rule ERR14ERR08-J. Do not catch NullPointerException or any of its ancestors to determine if whether the RuntimeException
was thrown.
...
This compliant solution throws the (NullPointerException
) to denote the specific exceptional condition.:
Code Block | ||
---|---|---|
| ||
boolean isCapitalized(String s) {
if (s == null) {
throw new NullPointerException();
}
if (s.equals("")) {
return true;
}
String first = s.substring(0, 1);
String rest = s.substring(1);
return (first.equals(first.toUpperCase()) &&
rest.equals(rest.toLowerCase()));
}
|
Note that the null check is redundant; if it were removed, the next subsequent call (to s.equals("")
) will would throw a NullPointerException
when s
is null. However, the explicit null check is a good form because it explicitly indicates the programmer's intent. More complex code may require explicit testing of invariants and appropriate throw
statements.
Noncompliant Code Example
This noncompliant code example specifies the Exception
class in the throws
clause of the method declaration for the doSomething()
method.:
Code Block | ||
---|---|---|
| ||
private void doSomething() throws Exception {
//...
}
|
...
This compliant solution declares a more specific exception class in the throws
clause of the method declaration for the doSomething()
method.:
Code Block | ||
---|---|---|
| ||
private void doSomething() throws IOException {
//...
}
|
Exceptions
EXC07ERR07-J-EX0: Classes that sanitize exceptions to comply with a security policy are permitted to translate specific exceptions into more general exceptions. This translation could potentially result in throwing RuntimeException
, Exception
, or Exception
Throwable
in some cases, depending on the details requirements of the security policy.
Risk Assessment
Throwing RuntimeException
and , Exception
, or Throwable
prevents classes from catching the intended exceptions without catching other unintended exceptions as well.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
ERR07-J |
Low |
Likely |
Medium | P6 | L2 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
CodeSonar |
| JAVA.STRUCT.EXCP.BROAD | Broad Throws Clause (Java) | ||||||
Parasoft Jtest |
| CERT.ERR07.NTX CERT.ERR07.NTERR | Avoid declaring methods to throw general or unchecked Exception types Do not throw exception types which are too general or are unchecked exceptions | ||||||
SonarQube |
| S112 | Generic exceptions should never be thrown |
Related Guidelines
Bibliography
...
[ |
] |
]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="720fc722-2a20-47f5-8b70-5f213041a664"><ac:plain-text-body><![CDATA[
[[Tutorials 2008
AA. Bibliography#Tutorials 08]]
[Unchecked Exceptions — The Controversy
http://java.sun.com/docs/books/tutorial/essential/exceptions/runtime.html]
]]></ac:plain-text-body></ac:structured-macro>
...
ERR06-J. Do not let code throw undeclared checked exceptions 06. Exceptional Behavior (ERR)