VNX-397: Declaration of Throws for Generic Exception

A Java method declares throws Exception or throws Throwable, so callers cannot tell which failures to handle. Overrides, main, Callable.call, close and Spring Security builder methods are not reported.

Field	Value
Rule ID	`VNX-397`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-397
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`error-handling` `cwe-397`
Source	`internal/sast/rules/vnx-397.rego`

Overview

VNX-397 maps to CWE-397: Declaration of Throws for Generic Exception. It reports a Java method or interface method that declares throws Exception or throws Throwable, alone, java.lang.-qualified or inside a list such as throws IOException, Exception, on the signature line or on the throws line of a multi-line signature.

Not reported: specific exception types (including names that only start with Exception, such as ExceptionInInitializerError); a method annotated @Override, whose signature the supertype dictates; main(String[]), Callable.call(), AutoCloseable.close() and InitializingBean.afterPropertiesSet(); Spring Security configuration methods taking HttpSecurity, WebSecurity, AuthenticationManagerBuilder or AuthenticationConfiguration, whose builders throw Exception themselves; sample, example and demo directories; a file declaring a @FunctionalInterface (a throwing functional interface, like Callable, has to declare the generic type); test files, comments, Javadoc and strings.

Why This Matters

throws Exception erases the contract. Every caller has to catch Exception, which also catches the runtime exceptions of its own bugs, and the compiler can no longer say when a new failure mode is introduced.

What Gets Flagged

public Report build(long id) throws Exception {          // FLAGGED

void importAll(String source) throws IOException, Exception;   // FLAGGED

public void replicate(
        Source source,
        Target target)
        throws Exception {                                // FLAGGED

Remediation

Declare the checked exceptions the method really throws (throws IOException, SQLException).
Wrap lower-level failures in a domain exception (throws ReportException).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-397
// nosec vnx-397

Or record an ignore rule: vulnetix ignore add --rule vnx-397 --reason "...". See Suppressing findings.