It is highly unlikely that a method is built to deal with all possible runtime exceptions; therefore no method should ever catch RuntimeException
. If a method catches RuntimeException
, it will receive exceptions it was not designed to handle, such as NullPointerException
. Many catch clauses simply log or ignore their error, and resume control flow. But runtime exceptions represent a bug in the program that should be fixed by the developer, and almost always lead to control flow vulnerabilities.
Likewise, a method should never catch Exception
, since this implies catching RuntimeException
.