396
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-961]Object Management Group (OMG). "Automated Source Code Reliability Measure
(ASCRM)". 2016 January. < http://www.omg.org/spec/ASCRM/1.0/ >.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-397: Declaration of Throws for Generic Exception
Weakness ID : 397
Structure : Simple
Abstraction : Base
Description
Throwing overly broad exceptions promotes complex error handling code that is more likely to
contain security vulnerabilities.
Extended Description
Declaring a method to throw Exception or Throwable makes it difficult for callers to perform proper
error handling and error recovery. Java's exception mechanism, for example, is set up to make it
easy for callers to anticipate what can go wrong and write code to handle each specific exceptional
circumstance. Declaring that a method throws a generic form of exception defeats this system.
CWE Version 4.14
CWE-397: Declaration of Throws for Generic Exception
CWE-397: Declaration of Throws for Generic Exception