The code contains too many jump instructions that derive the control flow out of a finally structure

·

[vc_row][vc_column][vc_btn title=”SOFTWARE RESILIENCY” style=”flat” color=”black” i_icon_fontawesome=”fa fa-shield” add_icon=”true” link=”url:http%3A%2F%2Fdoc.casthighlight.com%2Fsoftware-resiliency%2F|||”][vc_btn title=”CODE RELIABILITY” style=”outline” color=”black” i_icon_fontawesome=”fa fa-code” add_icon=”true” link=”url:http%3A%2F%2Fdoc.casthighlight.com%2Fcategory%2Fproduct%2Findicators-methodology%2Fcode-insights%2Fsoftware-resiliency%2Fcode-reliability%2F|||”][vc_empty_space height=”12px”][vc_row_inner][vc_column_inner][vc_column_text]

Why you should care

[/vc_column_text][vc_column_text]Using return, break, throw, and continue from a finally block overwrites similar statements from the suspended try and catch blocks.[/vc_column_text][vc_empty_space][/vc_column_inner][/vc_row_inner][vc_empty_space height=”12px”][vc_empty_space][vc_separator][vc_column_text]

How we detect

[/vc_column_text][vc_column_text]CAST Highlight counts one occurrence each time a jump statement (break, continue, return and throw) would force control flow to leave a finally block.

Bad Code

try {
console.log('test')
}
catch(e) {
console.log(e);
}
finally{
throw new Error('Something bad happened'); // Noncompliant
}

Good Code

function foo() {
try {
return 1; // We expect 1 to be returned
} catch(err) {
return 2; // Or 2 in cases of error
}
}

[/vc_column_text][vc_empty_space][vc_separator][vc_column_text]

References

[/vc_column_text][vc_column_text]https://wiki.sei.cmu.edu/confluence/display/java/ERR04-J.+Do+not+complete+abruptly+from+a+finally+block
https://owasp.org/www-community/vulnerabilities/Return_Inside_Finally_Block[/vc_column_text][vc_empty_space][vc_row_inner][vc_column_inner][vc_single_image image=”5362″ img_size=”full”][vc_column_text]

About CAST and Highlight’s Code Insights

Over the last 25 years, CAST has leveraged unique knowledge on software quality measurement by analyzing thousands of applications and billions of lines of code. Based on this experience and community standards on programming best practices, Highlight implements hundreds of code insights across 15+ technologies to calculate health factors of a software.

[/vc_column_text][vc_empty_space height=”16px”][vc_btn title=”SEE FEATURES” style=”flat” color=”black” i_icon_fontawesome=”fa fa-desktop” add_icon=”true” link=”url:https%3A%2F%2Fwww.castsoftware.com%2Fproducts%2Fhighlight%2Foutputs-analytics||target:%20_blank|”][vc_btn title=”HOW IT WORKS” style=”outline” color=”black” i_icon_fontawesome=”fa fa-cog” add_icon=”true” link=”url:https%3A%2F%2Fwww.castsoftware.com%2Fproducts%2Fhighlight%2Fhow-it-works||target:%20_blank|”][/vc_column_inner][/vc_row_inner][/vc_column][/vc_row]


Leave a Reply

Your email address will not be published. Required fields are marked *