Skip to main content

Insecure exceptions - Empty or no catch

Need​

Proper exception handling and error management

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

Future<shelf.Response> handleRequest(shelf.Request request) async {
  try {
    var response = await someOperation(request);
    return response;
  } catch {
    // Empty catch block
  }
}

In the code snippet above, we have a function handleRequest which is used to handle incoming requests in a backend application using the shelf framework in Dart.

Within this function, there is a try block that is executing a function someOperation, which can potentially throw an exception. The problem here is that we have an empty catch block following the try block.

The empty catch block is a significant vulnerability. When the someOperation function throws an exception, the catch block will catch it but does nothing to handle it. This means that the application will not be aware of any possible errors that occurred during the execution of the someOperation function.

This can lead to the application continuing to run in an erroneous state, which could lead to further problems down the line. In addition, the lack of error handling means that the application could become temporarily or permanently unavailable without any clear indication as to why.

Furthermore, this could also lead to poor user experience as the user might not receive any feedback about what went wrong, making it hard for them to understand what happened.

In conclusion, it's crucial to properly handle exceptions and provide meaningful feedback to maintain the stability and reliability of the application.

Steps​

  • Identify the types of exceptions that the code within the try block could potentially throw.
  • For each identified exception type, add a separate catch clause that handles that specific exception.
  • In each catch clause, add code to handle the exception appropriately. This could involve logging the error, returning a specific error message or status code, or retrying the operation, depending on the specific requirements of your application.
  • If there are potential exceptions that you are unsure how to handle, consider adding a general catch clause at the end to catch and handle any other exceptions. However, this should be used as a last resort, as it can make it harder to identify and fix issues.
  • Test the exception handling code to ensure it works as expected. This could involve unit tests, integration tests, or manual testing.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'dart:io';

Future<shelf.Response> handleRequest(shelf.Request request) async {
  try {
    var response = await someOperation(request);
    return response;
  } on IOException catch (e) {
    // Log the error
    print('An IO error occurred: $e');
    // Return a 500 Internal Server Error response
    return shelf.Response.internalServerError(body: 'An internal server error occurred');
  } catch (e) {
    // Log the error
    print('An unexpected error occurred: $e');
    // Return a 500 Internal Server Error response
    return shelf.Response.internalServerError(body: 'An unexpected error occurred');
  }
}

The updated code now includes proper exception handling. The try block contains the code that might throw an exception. If an exception is thrown within the try block, the catch block is executed.

There are two catch blocks in this code. The first catch block is specifically for IOException exceptions. This type of exception might be thrown if there is a problem with input/output operations, such as reading from or writing to a file. If an IOException is thrown, the error is logged to the console and a 500 Internal Server Error response is returned to the client.

The second catch block catches all other types of exceptions. If an exception that is not an IOException is thrown, this catch block is executed. Again, the error is logged to the console and a 500 Internal Server Error response is returned to the client.

This approach ensures that all exceptions are handled in some way, preventing the application from becoming unavailable due to unhandled exceptions. However, the specific error handling code in each catch block should be tailored to the specific requirements of your application.

References​

Last updated on