Return Inside Finally Block

Draft Base

Structure: Simple

Description

The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

Common Consequences 1

Scope: Other

Impact: Alter Execution Logic

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Potential Mitigations 1

Phase: Implementation

Do not use a return statement inside the finally block. The finally block should have "cleanup" code.

Demonstrative Examples 1

In the following code excerpt, the IllegalArgumentException will never be delivered to the caller. The finally block will cause the exception to be discarded.

Code Example:Bad
Java
java

Modes of Introduction

Implementation

Related Weaknesses

ChildOf:

Incorrect Control Flow Scoping (CWE-705)

Taxonomy Mapping

The CERT Oracle Secure Coding Standard for Java (2011)
The CERT Oracle Secure Coding Standard for Java (2011)
Software Fault Patterns