VNX-1069: Empty Exception Block

A Java catch block whose body is empty, on one line or across lines, so the exception is swallowed with no log, rethrow, return or recorded decision.

Field	Value
Rule ID	`VNX-1069`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-1069
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`empty-exception-block` `cwe-1069`
Source	`internal/sast/rules/vnx-1069.rego`

Overview

VNX-1069 maps to CWE-1069: Empty Exception Block. It reports a Java catch whose body holds nothing but whitespace, whether written on one line (catch (IOException e) {}) or across lines (the brace on the next line, an empty line inside).

It does not report a body holding any statement or a comment (a comment records the decision to ignore), an exception variable named ignored, ignore, expected, unused or _ (the Java convention for a deliberate discard), test sources, or catch text inside string literals and comments.

Why This Matters

An empty handler makes a failure disappear. A configuration file that failed to load, an interrupted thread or a rejected database write leaves no trace, and the program continues in a state nobody planned for.

What Gets Flagged

} catch (IOException e) {}                       // FLAGGED
} catch(NumberFormatException ex) { }            // FLAGGED
} catch (SQLException e) {                       // FLAGGED (empty body on the next lines)
}

Not flagged: catch (IOException ignored) {}, a body with // already closed, nothing to do, a body that logs or rethrows.

Remediation

Log the exception, rethrow it (wrapped if needed) or handle it.
When ignoring it is correct, name the variable ignored and say why in a comment.
Restore the interrupt flag (Thread.currentThread().interrupt()) when catching InterruptedException.

References

CWE-1069: Empty Exception Block

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1069
// nosec vnx-1069

Or record an ignore rule: vulnetix ignore add --rule vnx-1069 --reason "...". See Suppressing findings.