In the presence of a finally
block, irrespective of whether the try
or catch
blocks execute to completion or not, the finally
block is executed. Consequently, statements that cause the finally
block to terminate abruptly may mask any thrown exceptions. Keywords such as return
, break
, continue
and throw
should never be used within a finally
block.
Noncompliant Code Example
In this noncompliant code example, the finally
block completes abruptly because a return
statement occurs within its body. As a result, when the IllegalStateException
is thrown, it does not propagate all the way up through the call stack. This is because of the abrupt termination of the finally
block that suppresses any useful exception information from being displayed as a result of overriding the exception thrown in the try
block.
class TryFinally { private static boolean doLogic() { try { throw new IllegalStateException(); } finally { System.out.println("Uncaught Exception"); return true; } } public static void main(String[] args) { doLogic(); } }
Note that even if the try
block returns some value, the finally
block is executed.
Compliant Solution
This compliant solution removes the return
statement from the finally
block. Any return
statements must occur after this block. If this is adopted, the compiler throws an error as the return
statement is unreachable because of the explicit, unavoidable throwing of IllegalStateException
. If the exception is thrown conditionally, the return
statement can be used without any compilation errors.
class TryFinally { private static boolean doLogic() { try { throw new IllegalStateException(); } finally { System.out.println("Caught Exception"); } // any return statements must go here; applicable only when exception is thrown conditionally } public static void main(String[] args) { doLogic(); } }
Risk Assessment
Exiting abruptly from a finally
block may result in the masking of thrown exceptions.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
EXC04- J |
low |
probable |
medium |
P4 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[JLS 05]] Section 14.20.2, Execution of try-catch-finally
[[Bloch 05]] Puzzle 36: Indecision
[[Chess 07]] 8.2 Managing Exceptions, "The Vanishing Exception"
[[MITRE 09]] CWE ID 705 "Incorrect Control Flow Scoping", CWE ID 584 "Return Inside Finally Block"
EXC03-J. Use a logging API to log critical security exceptions 13. Exceptional Behavior (EXC) EXC05-J. Handle checked exceptions that can be thrown within a finally block