Throw From Finally Block

ID

java.throw_from_finally_block

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

CWE:584, reliability

Description

Reports throw statements inside finally blocks.

Rationale

A throw inside a finally block replaces whatever exception was propagating from the try or catch block. This means the original failure is silently discarded and can never be caught or logged, making production incidents extremely difficult to diagnose.

// Bad - throw in finally discards the original exception
try {
    processFile(path);
} finally {
    throw new RuntimeException("cleanup failed");
}

Remediation

Move the throwing logic out of the finally block, or catch exceptions within finally so they do not mask the original one:

// Good - log errors in finally, do not throw
try {
    processFile(path);
} finally {
    try {
        cleanup();
    } catch (Exception e) {
        log.warn("Cleanup failed", e);
    }
}

References