Use of NullPointerException Catch to Detect NULL Pointer Dereference

Opis

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

Programmers typically catch NullPointerException under three circumstances:

- The program contains a null pointer dereference. Catching the resulting exception was easier than fixing the underlying problem.

- The program explicitly throws a NullPointerException to signal an error condition.

- The code is part of a test harness that supplies unexpected input to the classes under test.

Of these three circumstances, only the last is acceptable.

Skutki

• Availability

  DoS: Resource Consumption (CPU)

Zapobieganie

• Architecture and Design, Implementation

  Do not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.

Słabość nadrzędna

• CWE-705 Incorrect Control Flow Scoping
• CWE-755 Improper Handling of Exceptional Conditions

Kiedy powstaje

• Implementation

Dotyczy

Java

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014