rspec/rules/S1147/java/rule.adoc

== Why is this an issue?

Calling ``++System.exit(int status)++`` or ``++Rutime.getRuntime().exit(int status)++`` calls the shutdown hooks and shuts downs the entire Java virtual machine. Calling ``++Runtime.getRuntime().halt(int)++`` does an immediate shutdown, without calling the shutdown hooks, and skipping finalization.


Each of these methods should be used with extreme care, and only when the intent is to stop the whole Java process. For instance, none of them should be called from applications running in a J2EE container.

=== Noncompliant code example

[source,java]
----
System.exit(0);
Runtime.getRuntime().exit(0);
Runtime.getRuntime().halt(0);
----

=== Exceptions

These methods are ignored inside ``++main++``.

== Resources

* https://cwe.mitre.org/data/definitions/382[MITRE, CWE-382] - Use of System.exit()
* https://wiki.sei.cmu.edu/confluence/x/7zZGBQ[CERT, ERR09-J.] - Do not allow untrusted code to terminate the JVM

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

=== on 17 Aug 2017, 17:36:38 Pierre-Yves Nicolas wrote:
\[~jeanchristophe.collet] I moved the description from RSPEC-1147 here. The only difference is the addition of the second link in the "See" section: CERT, ERR09-J. Please check that it makes sense.

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]