VNX-755: Interrupt or JVM error caught and swallowed

Reports Java catch blocks that drop an InterruptedException without restoring the interrupt, rethrowing or leaving the work, and catch blocks that handle a JVM Error (OutOfMemoryError, StackOverflowError, ...) without rethrowing or ending the process.

Field	Value
Rule ID	`VNX-755`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-755
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`exceptional-conditions` `interrupted-exception` `cwe-755`
Source	`internal/sast/rules/vnx-755.rego`

Overview

VNX-755 maps to CWE-755: Improper Handling of Exceptional Conditions. It reports two handlers that absorb conditions they should not:

catch (InterruptedException e), alone or in a multi-catch, when the body does none of these: call Thread.currentThread().interrupt(), throw, return, break. The thread loses the request to stop, so shutdown, timeouts and executor cancellation no longer work. A handler that is the last statement of a run(), call() or lambda body is not reported, because the thread ends right after it.
catch of a JVM Error: Error, VirtualMachineError, OutOfMemoryError, StackOverflowError, InternalError, ThreadDeath or LinkageError, when the body does not rethrow.

What Gets Flagged

try {
    Thread.sleep(1000);
} catch (InterruptedException e) {   // FLAGGED: interrupt lost
    // keep polling
}

} catch (OutOfMemoryError oom) {     // FLAGGED: execution continues
    return new byte[0];
}

Not reported: handlers that restore the interrupt, rethrow, wrap, return or break. Also not reported: catch (Throwable) and catch (Exception), which VNX-396 and VNX-391 cover, test code and comments.

Remediation

In an InterruptedException handler, call Thread.currentThread().interrupt() or rethrow.
Let JVM errors propagate, or rethrow them once cleanup is done.

References

CWE-755: Improper Handling of Exceptional Conditions

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-755
// nosec vnx-755

Or record an ignore rule: vulnetix ignore add --rule vnx-755 --reason "...". See Suppressing findings.