CWE-584 在最后的代码块中返回

Return Inside Finally Block

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 705 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
Other Alter Execution Logic

可能的缓解方案

Implementation

策略:

Do not use a return statement inside the finally block. The finally block should have "cleanup" code.

示例代码

例

In the following code excerpt, the IllegalArgumentException will never be delivered to the caller. The finally block will cause the exception to be discarded.

bad Java

try {
...
throw IllegalArgumentException();
}
finally {
return r;
}

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
The CERT Oracle Secure Coding Standard for Java (2011) ERR04-J Do not complete abruptly from a finally block
The CERT Oracle Secure Coding Standard for Java (2011) ERR05-J Do not let checked exceptions escape from a finally block
Software Fault Patterns SFP6 Incorrect Exception Behavior