16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
44 lines
1.4 KiB
Plaintext
44 lines
1.4 KiB
Plaintext
== Why is this an issue?
|
|
|
|
Calling ``++System.exit(int status)++`` or ``++Rutime.getRuntime().exit(int status)++`` calls the shutdown hooks and shuts downs the entire Java virtual machine. Calling ``++Runtime.getRuntime().halt(int)++`` does an immediate shutdown, without calling the shutdown hooks, and skipping finalization.
|
|
|
|
|
|
Each of these methods should be used with extreme care, and only when the intent is to stop the whole Java process. For instance, none of them should be called from applications running in a J2EE container.
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,java]
|
|
----
|
|
System.exit(0);
|
|
Runtime.getRuntime().exit(0);
|
|
Runtime.getRuntime().halt(0);
|
|
----
|
|
|
|
=== Exceptions
|
|
|
|
These methods are ignored inside ``++main++``.
|
|
|
|
== Resources
|
|
|
|
* https://cwe.mitre.org/data/definitions/382[MITRE, CWE-382] - Use of System.exit()
|
|
* https://wiki.sei.cmu.edu/confluence/x/7zZGBQ[CERT, ERR09-J.] - Do not allow untrusted code to terminate the JVM
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 17 Aug 2017, 17:36:38 Pierre-Yves Nicolas wrote:
|
|
\[~jeanchristophe.collet] I moved the description from RSPEC-1147 here. The only difference is the addition of the second link in the "See" section: CERT, ERR09-J. Please check that it makes sense.
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|