VNX-584: Return Inside Finally Block

Reports a return statement inside a finally block in Java, JavaScript/TypeScript and Python, which discards any exception from the try block. Returns inside lambdas, callbacks or nested functions in the block are not reported.

Field	Value
Rule ID	`VNX-584`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-584
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`return-in-finally` `cwe-584`
Source	`internal/sast/rules/vnx-584.rego`

Overview

VNX-584 maps to CWE-584: Return Inside Finally Block. It reports a return inside a finally block at any depth (inside an if, a nested try), including the one-line form finally { return x; }. The block is bounded by brace depth, or indentation for Python, within 80 lines.

Why This Matters

A return in finally completes the whole try statement normally. Any exception thrown by the try or catch block is silently dropped, and the try block’s own return value is replaced. Failures such as a failed write, an authorisation error or a parse error then look like success to the caller.

What Gets Flagged

} finally {
    stream.close();
    return -1;
}

} finally { return undefined; }

finally:
    if cache is not None:
        return cache

Not flagged: a return after the finally block closes, a return in the try or catch block, a return inside a lambda, arrow function, anonymous class or nested def opened in the finally block, comments and strings.

Remediation

Move the return after the try/finally statement, or into the try block.
Keep finally for cleanup only; if cleanup can fail, record that failure without replacing the original exception (for example with addSuppressed).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-584
// nosec vnx-584

Or record an ignore rule: vulnetix ignore add --rule vnx-584 --reason "...". See Suppressing findings.