CPP: Add a query to find incorrectly used exceptions. #6082
Conversation
cpp/ql/src/experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
Show resolved
Hide resolved
| not fc instanceof ConstructorDirectInit and | ||
| not fc.getEnclosingStmt() instanceof DeclStmt and | ||
| not fc instanceof ConstructorDelegationInit and | ||
| msg = "This object does not generate an exception." |
There was a problem hiding this comment.
This case looks interesting. Can you give an example (preferably a test case) demonstrating what it is trying to catch?
There was a problem hiding this comment.
Actually I am looking for objects of type std :: exception that do not throw exceptions.
a basic example can be seen in PR. I will try to make a test case a little later.
There was a problem hiding this comment.
So, broadly, it's looking for cases where a std::exception object is created but not as part of a throw? e.g. the author writes
std::bad_alloc();
when they meant to write:
throw std::bad_alloc();
|
Good day. |
| <li> | ||
| CERT CPP Coding Standard: | ||
| <a href="https://wiki.sei.cmu.edu/confluence/display/cplusplus/DCL57-CPP.+Do+not+let+exceptions+escape+from+destructors+or+deallocation+functions">DCL57-CPP. Do not let exceptions escape from destructors or deallocation functions</a>. | ||
| <a href="https://wiki.sei.cmu.edu/confluence/display/java/ERR00-J.+Do+not+suppress+or+ignore+checked+exceptions">ERR00-J. Do not suppress or ignore checked exceptions</a>. |
There was a problem hiding this comment.
This page is about the Java language. Please would you replace it with an equivalent C/C++ link?
| not ts.getACatchClause().isEmpty() | ||
| ) and | ||
| msg = "This distructor contains exeption no wrapped to try..catch blocks" | ||
| msg = "Exception inside this function requires more handling." |
There was a problem hiding this comment.
So this is now looking for a throw statement inside a called function, that is not caught/handled inside that function. This seems like something that normal correct code would be doing fairly frequently, for example a function that's supposed to access a file might reasonably throw an exception if that file doesn't exist.
|
it looks stupid. ( sorry for wasting time. |
2 participants
Good day.
in this request I am looking for errors when using exceptions.
I have identified 2 main areas:
Regarding fixes in real software, my proposal is pending, but I plan to continue searching.
assimp/assimp#3954