The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)

Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

The product detects a specific error, but takes no actions to handle the error.

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the und...

The product generates an error message that includes sensitive information about its environment, users, or associated data.

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank...

The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

A J2EE application uses System.exit(), which also shuts down its container.

The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

An exception is thrown from a function, but it is not caught.

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer der...

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" pu...