963
doing so hampers the caller's ability to understand and handle the exceptions that occur. Further,
if a later revision of doExchange() introduces a new type of exception that should be treated
differently than previous exceptions, there is no easy way to enforce this requirement.
Example 2:
Early versions of C++ (C++98, C++03, C++11) included a feature known as Dynamic Exception
Specification. This allowed functions to declare what type of exceptions it may throw. It is possible
to declare a general class of exception to cover any derived exceptions that may be throw.
Example Language: (Bad)
int myfunction() throw(std::exception) {
if (0) throw out_of_range();
throw length_error();
}
In the example above, the code declares that myfunction() can throw an exception of type
"std::exception" thus hiding details about the possible derived exceptions that could potentially be
thrown.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 388 7PK - Errors 700 2322
MemberOf 851 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 8 - Exceptional Behavior (ERR)
844 2365
MemberOf 960 SFP Secondary Cluster: Ambiguous Exception Type 888 2399
MemberOf 1129 CISQ Quality Measures (2016) - Reliability 1128 2440
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1141 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 07. Exceptional Behavior (ERR)
1133 2448
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Notes
Applicable Platform
For C++, this weakness only applies to C++98, C++03, and C++11. It relies on a feature known
as Dynamic Exception Specification, which was part of early versions of C++ but was deprecated
in C++11. It has been removed for C++17 and later.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Overly-Broad Throws Declaration
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR07-J Do not throw RuntimeException,
Exception, or Throwable
Software Fault Patterns SFP5 Ambiguous Exception Type
OMG ASCSM ASCSMCWE-