A switch
block comprises several case
labels and an optional but highly recommended default
label. By convention, statements Statements that follow each case
label must end with a break
statement, which is responsible for transferring the control to the end of the switch
block. When omitted, the next statement statements in the subsequent case
label gets are executed. Because the break
statement is optional, its omission omitting it produces no compiler warnings. If When this behavior is unintentional, it can lead to undesirable control flowscause unexpected control flow.
Noncompliant Code Example
In this noncompliant code example, the case wherein where the card
is 11
does not have lacks a break
statement. Thus, As a result, execution continues with the statements for card = 12
are also executed when card = 11
.
Code Block | ||
---|---|---|
| ||
int card = 11; switch (card) { /* ... */ case 11: System.out.println("Jack"); case 12: System.out.println("Queen"); break; case 13: System.out.println("King"); break; default: System.out.println("Invalid Card"); break; } |
Compliant Solution
In this This compliant solution , terminates each case (including the default
case) is terminated by with a break
statement.:
Code Block | ||
---|---|---|
| ||
int card = 11;
switch (card) {
/* ... */
case 11:
System.out.println("Jack");
break;
case 12:
System.out.println("Queen");
break;
case 13:
System.out.println("King");
break;
default:
System.out.println("Invalid Card");
break;
}
|
Exceptions
Applicability
Failure to include break
statements can cause unexpected control flow.
The break
statement at the end of the final case in a switch
statement may be omitted. By convention, this is the default
labelEX1: The last label in a switch statement requires no break. The break
statement serves to skip to transfer control to the end of the switch
block. Fall-through behavior also causes control to arrive at the end of the switch
block. Consequently, so control flow will continue transfers to the statements following the switch
block with or without it. Conventionally, the last label is the default label.EX2without regard to the presence or absence of the break
statement. Nevertheless, the final case in a switch
statement should end with a break
statement in accordance with good programming style [Vermeulen 2000].
Exceptionally, when multiple cases require execution of identical code, break
statements may be omitted from all cases except the last one. Similarly, when processing for one case is a proper prefix of processing for one or more other cases, the break
statement may be omitted from the prefix case. This should be clearly indicated with a comment. For example:: In some cases, where control flow is intended to execute the same code for multiple cases, it is permissible to omit the break statement. However, these instances must be explicitly documented.
Code Block | ||
---|---|---|
| ||
int card = 11; int value; /*/ CaseCases 11,12,13 fall through to the same case */ switch (card) { // Processing for this case requires a prefix /* MSC13-J:EX2: these/ of the actions for the following three case 10: do_something(card); // Intentional fall-through // These three cases are treated identically */ case 11: // Break not required case 12: // Break not required case 13: value = 10; break; // Break required default: /*/ Handle Errorerror Conditioncondition */ } |
EX3: A case needs no break
statement if its last statement is Also, when a case ends with a return
or throw
.
Risk Assessment
Failure to include break statements leads to unexpected control flow.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
MSC13-J | medium | unlikely | low | P6 | L2 |
Other Languages
This rule appears in the C Secure Coding Standard as MSC17-C. Finish every set of statements associated with a case label with a break statement.
This rule appears in the C++ Secure Coding Standard as MSC18-CPP. Finish every set of statements associated with a case label with a break statement.
References
statement, the break
statement may be omitted.
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
Parasoft Jtest |
| CERT.MSC52.SBC | Do not use a "switch" statement with a bad "case" | ||||||
SonarQube |
| S128 |
Bibliography
...
\[[JLS 05|AA. Java References#JLS 05]\] [Section 14.11 The switch Statement|http://java.sun.com/docs/books/jls/third_edition/html/statements.html#14.11] Wiki Markup