Return From Finally Block

ID

java.return_from_finally

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

CWE:584, reliability

Description

Reports return statements inside finally blocks.

Rationale

A return inside a finally block silently discards any exception that was propagating from the try or catch block. It also overrides any value returned by the try/catch. This makes failures undiagnosable in production:

public int compute() {
    try {
        return riskyOperation();
    } finally {
        return -1;  // Discards any exception AND overrides the try return value
    }
}

Remediation

Move the return logic out of the finally block. The finally block should only contain cleanup code:

public int compute() {
    try {
        return riskyOperation();
    } finally {
        cleanup();
        // Do not return here
    }
}

References