Empty Catch Block

ID

kotlin.empty_catch_block

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Kotlin

Tags

CWE:1069, error-handling, exception

Description

Reports catch blocks with an empty body that silently discard exceptions.

An empty catch makes failures invisible: the program continues as if nothing happened, often in a corrupt or inconsistent state. At a minimum the exception should be logged; in many cases it should be re-thrown or used to take corrective action.

The conventional allow-list idiom is to name the catch parameter ignored or _, which signals the suppression is deliberate.

Rationale

// Bad — IOException silently lost
try {
    file.delete()
} catch (e: IOException) { }  // FLAW

// OK — documented intentional ignore
try {
    file.delete()
} catch (ignored: IOException) { }

// OK — Kotlin wildcard catch parameter
try {
    file.delete()
} catch (_: IOException) { }

// Good — exception logged
try {
    file.delete()
} catch (e: IOException) {
    logger.error("Failed to delete file", e)
}

Remediation

  • Log the exception with context information.

  • Re-throw it (wrapped or unwrapped) if the caller should handle it.

  • If the suppression is intentional, rename the parameter to ignored or _ to document it.

References