959
Nature Type ID Name Page
MemberOf 388 7PK - Errors 700 2322
MemberOf 851 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 8 - Exceptional Behavior (ERR)
844 2365
MemberOf 962 SFP Secondary Cluster: Unchecked Status Condition 888 2400
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Catching NullPointerException
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR08-J Do not catch NullPointerException or
any of its ancestors
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-396: Declaration of Catch for Generic Exception
Weakness ID : 396
Structure : Simple
Abstraction : Base
Description
Catching overly broad exceptions promotes complex error handling code that is more likely to
contain security vulnerabilities.
Extended Description
Multiple catch blocks can get ugly and repetitive, but "condensing" catch blocks by catching a highlevel
class like Exception can obscure exceptions that deserve special treatment or that should not
be caught at this point in the program. Catching an overly broad exception essentially defeats the
purpose of a language's typed exceptions, and can become particularly dangerous if the program
grows and begins to throw new types of exceptions. The new exception types will not receive any
attention.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 221 Information Loss or Omission 556
ChildOf 755 Improper Handling of Exceptional Conditions 1576
ChildOf 705 Incorrect Control Flow Scoping 1542
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-396: Declaration of Catch for Generic Exception
CWE-396: Declaration of Catch for Generic Exception