CWE-397: Declaration of Throws for Generic Exception
Declaration of Throws for Generic Exception
Weakness ID: 397 (Weakness Base)
Status: Draft
Description
Description Summary
Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
Extended Description
Declaring a method to throw Exception or Throwable makes it difficult for callers to perform proper error handling and error recovery. Java's exception mechanism, for example, is set up to make it easy for callers to anticipate what can go wrong and write code to handle each specific exceptional circumstance. Declaring that a method throws a generic form of exception defeats this system.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
C++
Java
.NET
Common Consequences
Scope
Effect
Non-Repudiation
Other
Technical Impact: Hide activities; Alter execution
logic
Demonstrative Examples
Example 1
The following method throws three types of exceptions.
(Good Code)
Example
Language: Java
public void doExchange() throws IOException,
InvocationTargetException, SQLException {
...
}
While it might seem tidier to write
(Bad Code)
public void doExchange() throws Exception {
...
}
doing so hampers the caller's ability to understand and handle the
exceptions that occur. Further, if a later revision of doExchange()
introduces a new type of exception that should be treated differently
than previous exceptions, there is no easy way to enforce this
requirement.
Description
