Empty Catches may cause security risks

[vc_row][vc_column]Software ResiliencyProgramming Best Practices[vc_empty_space height=”12px”][vc_row_inner][vc_column_inner width=”1/2″][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Why you should care

[/vc_column_text][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Most developers contend that it’s not ideal to have an empty catch block. Empty Catch is the cause of an exception occurring where nothing happens and the program fails. When such an exception occurs, it can be thrown up to the caller, or caught in catch block. Usually its considered to be flawed programming practice when an empty catch occurs. It can result in exposing a stack trace or maybe even a security risk.

[/vc_column_text][/vc_column_inner][vc_column_inner width=”1/2″][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Business Impacts

Empty catch blocks are considered a risk from a business perspective as it can pose security issues. Risks can involve programmers and/or the company are unaware of the security being compromised.
[/vc_column_text]Production Risk[/vc_column_inner][/vc_row_inner][vc_empty_space height=”12px”][vc_empty_space height=”32px”][vc_single_image image=”5362″ img_link_large=”” img_link_target=”_self” img_size=”full” alignment=”none”][vc_row_inner][vc_column_inner width=”1/2″][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

CAST Recommendations

CAST Recommends enforcing a Style Guide for the company that strongly suggests avoiding the use of empty-catch blocks to solve a problem in the code.  Instead teams should be encouraged to collaborate and work on the problem together through communication.[/vc_column_text][/vc_column_inner][vc_column_inner width=”1/2″][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

References

https://stackoverflow.com/questions/1234343/why-are-empty-catch-blocks-a-bad-idea[/vc_column_text]Style Guide[/vc_column_inner][/vc_row_inner][vc_separator color=”grey” align=”align_center” style=”” border_width=”” el_width=””][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

How we detect

[/vc_column_text][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

This code insight shows that catching an exception provides robustness treatment or error management. A catch doing nothing can masks an error, allowing the program to pursue and ignore the problem.

[/vc_column_text][vc_separator color=”grey” align=”align_center” style=”” border_width=”” el_width=””][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Cloud Readiness

[/vc_column_text]Versions & Deprecated Code[vc_empty_space height=”12px”][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Ineffective use of the provided stack: Having an empty catch in the program can mask errors that can misinterpreted when migrating to the cloud.

[/vc_column_text][vc_row_inner][vc_column_inner width=”1/1″][vc_single_image image=”5362″ img_link_large=”” img_link_target=”_self” img_size=”full” alignment=”none”][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

About CAST and Highlight’s Code Insights

Over the last 25 years, CAST has leveraged unique knowledge on software quality measurement by analyzing thousands of applications and billions of lines of code. Based on this experience and community standards on programming best practices, Highlight implements hundreds of code insights across 15+ technologies to calculate health factors of a software.

[/vc_column_text][vc_empty_space height=”16px”]See featuresHow it works[/vc_column_inner][/vc_row_inner][/vc_column][/vc_row]

?>