VNX-396: Declaration of Catch for Generic Exception

A catch of Exception, RuntimeException or Throwable (Java) or Exception/bare catch (C#) whose body neither rethrows nor uses the caught exception, turning every failure into the same default.

Field	Value
Rule ID	`VNX-396`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, C#
CWE	CWE-396
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`error-handling` `cwe-396`
Source	`internal/sast/rules/vnx-396.rego`

Overview

VNX-396 maps to CWE-396: Declaration of Catch for Generic Exception. It reports Java catch (Exception e), catch (RuntimeException e) and catch (Throwable t) (including final and java.lang. forms), and C# catch (Exception), catch (Exception ex) and a bare catch, whose body neither rethrows nor references the caught exception: it is not logged, wrapped or recorded, and every failure, including unrelated programming errors, becomes the same return null, return false or flag.

Not reported: a generic catch that logs, wraps, records or rethrows (throw;, throw e), a catch of a specific type, a variable named ignored/ignore/expected/unused, an empty Java catch body (VNX-391 reports that), test files, comments and strings.

Why This Matters

A generic catch answers questions the code never asked. A lookup that fails because the database is down, because of a bug, or because the row is absent all return null, and the cause is lost at the one place it was known.

What Gets Flagged

} catch (Exception e) {          // FLAGGED: e is never used
    return null;
}

catch (Exception)                // FLAGGED
{
    return null;
}

Remediation

Catch the specific exceptions the call declares or is documented to throw.
If a broad boundary catch is needed, log the exception with its stack trace or wrap and rethrow it.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-396
// nosec vnx-396

Or record an ignore rule: vulnetix ignore add --rule vnx-396 --reason "...". See Suppressing findings.