rspec/rules/S1143/java/rule.adoc
Egon Okerman d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00

90 lines
2.0 KiB
Plaintext

== Why is this an issue?
Using ``++return++``, ``++break++``, ``++throw++``, and so on from a ``++finally++`` block suppresses the propagation of any unhandled ``++Throwable++`` which was thrown in the ``++try++`` or ``++catch++`` block.
This rule raises an issue when a jump statement (``++break++``, ``++continue++``, ``++return++``, ``++throw++``, and ``++goto++``) would force control flow to leave a ``++finally++`` block.
=== Noncompliant code example
[source,java]
----
public static void main(String[] args) {
try {
doSomethingWhichThrowsException();
System.out.println("OK"); // incorrect "OK" message is printed
} catch (RuntimeException e) {
System.out.println("ERROR"); // this message is not shown
}
}
public static void doSomethingWhichThrowsException() {
try {
throw new RuntimeException();
} finally {
for (int i = 0; i < 10; i ++) {
//...
if (q == i) {
break; // ignored
}
}
/* ... */
return; // Noncompliant - prevents the RuntimeException from being propagated
}
}
----
=== Compliant solution
[source,java]
----
public static void main(String[] args) {
try {
doSomethingWhichThrowsException();
System.out.println("OK");
} catch (RuntimeException e) {
System.out.println("ERROR"); // "ERROR" is printed as expected
}
}
public static void doSomethingWhichThrowsException() {
try {
throw new RuntimeException();
} finally {
for (int i = 0; i < 10; i ++) {
//...
if (q == i) {
break; // ignored
}
}
/* ... */
}
}
----
== Resources
* CWE - https://cwe.mitre.org/data/definitions/584[CWE-584 - Return Inside Finally Block]
* https://wiki.sei.cmu.edu/confluence/x/BTdGBQ[CERT, ERR04-J.] - Do not complete abruptly from a finally block
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
'''
== Comments And Links
(visible only on this page)
include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]