VNX-390: Detection of Error Condition Without Action

A Java catch block that is empty, or whose only statement evaluates the exception and discards the result, so a detected failure is silently dropped.

Field	Value
Rule ID	`VNX-390`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-390
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`error-handling` `cwe-390`
Source	`internal/sast/rules/vnx-390.rego`

Overview

VNX-390 maps to CWE-390: Detection of Error Condition Without Action. It reports a catch block whose body is empty (on one line, catch (E e) {}, or across lines with only blank lines before the closing brace), and a catch block whose only statement evaluates the exception and drops the value (e.toString();, e.getMessage();).

Not reported: a catch block that logs, rethrows, returns, restores the interrupt flag or does anything else; an empty block with a comment explaining why; an exception variable named ignored, ignore, expected, unused or _; test sources; comments and string literals.

Why This Matters

Swallowing an exception lets the program continue with whatever partial state the try block left: a half-written file, a missing configuration value, an unauthenticated connection. Nothing records that it happened, so the failure surfaces later and elsewhere.

What Gets Flagged

} catch (IOException e) {          // FLAGGED
}

} catch (Exception e) {}           // FLAGGED

} catch (JSONException e) {        // FLAGGED
    e.toString();
}

Not flagged: catch (IOException e) { log.warn("cannot read", e); }, catch (InterruptedException e) { Thread.currentThread().interrupt(); }, catch (NumberFormatException ignored) {}, an empty block containing // optional file, defaults apply.

Remediation

Log the exception, rethrow it (wrapped if needed), or handle the failure explicitly.
If ignoring it is correct, name the variable ignored and add a comment saying why.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-390
// nosec vnx-390

Or record an ignore rule: vulnetix ignore add --rule vnx-390 --reason "...". See Suppressing findings.