You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

It is highly unlikely that a method is built to deal with all possible runtime exceptions; therefore no method should ever catch RuntimeException. If a method catches RuntimeException, it will receive exceptions it was not designed to handle, such as NullPointerException. Many catch clauses simply log or ignore their error, and resume control flow. But runtime exceptions represent a bug in the program that should be fixed by the developer, and almost always lead to control flow vulnerabilities.

Likewise, a method should never catch Exception, since this implies catching RuntimeException.

  • No labels