533
Alternate Terms
Missing Catch Block :
Common Consequences
Scope Impact Likelihood
Confidentiality
Availability
Read Application Data
DoS: Crash, Exit, or Restart
Potential Mitigations
Phase: Implementation
Implement Exception blocks to handle all types of Exceptions.
Demonstrative Examples
Example 1:
The following example attempts to resolve a hostname.
Example Language: Java (Bad)
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {
String ip = req.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
...
out.println("hello " + addr.getHostName());
}
A DNS lookup failure will cause the Servlet to throw an exception.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 851 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 8 - Exceptional Behavior (ERR)
844 2365
MemberOf 962 SFP Secondary Cluster: Unchecked Status Condition 888 2400
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Notes
Maintenance
The "Missing Catch Block" concept is probably broader than just Servlets, but the broader
concept is not sufficiently covered in CWE.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR01-J Do not allow exceptions to expose
sensitive information
CWE Version 4.14
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')