EXC05-J. Handle checked exceptions that can be thrown within a finally block

An exception can occur in the finally block despite compile-time checking. This can prevent other clean-up statements from being executed.

Noncompliant Code Example

The finally clause closes the reader object in this noncompliant code example. However, it is incorrectly assumed that the statements within the finally block cannot throw exceptions. Notably, the close() method can throw an IOException which prevents any subsequent clean-up lines from being executed. This is not detected at compile time as the type of exception that close() throws is the same as the type of exceptions that the methods read() and write() throw.

public class Operation {
  static void doOperation(String some_file) throws IOException {
    BufferedReader reader = new BufferedReader(new FileReader(some_file));
    // Do operations 
     
    } finally {
      reader.close();
      // Other clean-up code 
    }
}

  public static void main(String[] args) throws IOException {
    String path = "somepath";
    doOperation(path);
  }
}

Compliant Solution (1)

This compliant solution correctly places the close() statement in a try-catch block. As a result, an IOException can be handled without letting it propagate any further.

public class Operation {
  static void doOperation(String some_file) throws IOException {
    BufferedReader reader = new BufferedReader(new FileReader(some_file));

    try {
      // Do operations
    } finally {
        try {    
          // Enclose in try-catch block
          reader.close();
        } catch (IOException ie) {
          // Forward to handler
        }
        // Other clean-up code
    }
  }

  public static void main(String[] args) throws IOException {
    String path = "somepath";
    doOperation(path);
  }
}

Compliant Solution (2)

If there is a frequent need to close a stream without throwing an exception, an alternative solution to wrapping every call to close() in its own try-catch block is to use a closeIgnoringException() method, as shown in this compliant solution.

public class Operation {
  static void doOperation(String some_file) throws IOException {
    BufferedReader reader = new BufferedReader(new FileReader(some_file));

    try {
      // Do operations
    } finally {
      closeIgnoringException(reader);
      // Other clean-up code 
    }
}

  private static void closeIgnoringException(BufferredReader s) {
    if (s != null) {
      try {
        s.close();
      } catch (IOException ie) {
        // Ignore exception if close fails
      }
    }
  }

  public static void main(String[] args) throws IOException {
    String path = "somepath";
    doOperation(path);
  }
}

Risk Assessment

Failing to handle an exception in a finally block can lead to unexpected results.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
EXC05- J	low	unlikely	medium	P2	L3

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[Bloch 05]] Puzzle 41: Field and Stream
[[Harold 99]]
[[Chess 07]] 8.3 Preventing Resource Leaks (Java)

EXC04-J. Do not exit abruptly from a finally block 13. Exceptional Behavior (EXC) EXC06-J. Do not allow exceptions to transmit sensitive information

Space shortcuts

Page tree