EXC00-J. Do not suppress or ignore checked exceptions

Programmers often fall into the trap of suppressing or ignoring checked exceptions. Unless there is a valid reason for ignoring exceptions, such as the client cannot be expected to stage a recovery, it is important to handle them appropriately. The thrown exception disrupts the expected control flow of the application and care must be taken to not assume that the expected control flow has happened after catching an exception. The implication of not ignoring an exception is that the application does not assume normal control flow occurred after catching an exception and the application bases its future long term behavior on the fact that the exception was thrown. Failure to take the actual system state into account after the throwing of an exception may result in security problems as the application continues to execute.

Noncompliant Code Example

In this noncompliant example, the programmer leaves the catch block adorned with an ignore comment.

try {
  //...
}catch(IOException ioe) { /* ignore */ }

Noncompliant Code Example

Printing the exception's stack trace can be useful for debugging but is equivalent to ignoring the exception, as this noncompliant code example demonstrates.

try {
  //...
}catch(IOException ioe) { ioe.printStacktrace(); }

Note that even though the application reacts to the exception by printing out a stack trace, the application still proceeds as if the exception was not thrown, that is, the future long term behavior of the application does not change based on the throwing of the exception. Given that the thrown IOException indicates that an operation attempted by the application failed, it is unlikely that the application will be able to operate successfully in the future by assuming that the attempted operation succeeded.

Compliant Solution

This compliant solution attempts to recover from a FileNotFoundException by forcing the user to specify another file when a particular file does not exist in the user-specific directory.

try {
  // Requested file does not exist
}catch(FileNotFoundException e) { /* ask the user for a different filename */ }

Exceptions

EX1: It is reasonable to ignore handling an exception that occurs within a catch or finally block, such as when closing a FileInputStream object.

EX2: It is also permissible to ignore handling an exception when it is not possible to recover from the exceptional condition at that abstraction level. In such cases, the exception must be thrown so that higher level code can try recovering from the exceptional condition by catching and handling it.

// when recovery is possible at higher levels
private void doSomething() throws FileNotFoundException {
  // Requested file does not exist; throws FileNotFoundException
  // Higher level code can handle it by displaying a dialog box and asking 
  // the user for the file name
}

If the higher level code is also incapable of staging a recovery, the checked exception may be wrapped in an unchecked exception and re-thrown.

try {
  // Requested file does not exist
  // User is unable to supply the file name
}catch(FileNotFoundException e) { 
  throw new RuntimeException(e);
}

Risk Assessment

Ignoring or suppressing exceptions violates the fail-safe criteria of an application.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[JLS 05]] Chapter 11, Exceptions
[[Bloch 08]] Item 65: "Don't ignore exceptions", Item 62: "Document all exceptions thrown by each method"
[[MITRE 09]] CWE ID 390 "Detection of Error Condition Without Action"

11. Exceptional Behavior (EXC)      11. Exceptional Behavior (EXC)      EXC01-J. Do not allow exceptions to transmit sensitive information