No Catch Error

ID

kotlin.no_catch_error

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

Kotlin

Tags

CWE:396, catch, exception

Description

Reports catch (e: Error) blocks. Error and its subclasses (OutOfMemoryError, StackOverflowError, VirtualMachineError, …​) indicate serious problems that a reasonable application should not attempt to recover from.

Rationale

// Bad — masks JVM-level failures
try { ... } catch (e: Error) { ... }             // FLAW
try { ... } catch (e: java.lang.Error) { ... }   // FLAW

// OK — catch the specific business exception
try { ... } catch (e: IllegalStateException) { ... }

// OK — last-resort top-of-thread handler (not flagged because type is Throwable)
try { ... } catch (e: Throwable) { /* log and crash */ }

Catching Error swallows out-of-memory and stack-overflow conditions, allows a corrupted JVM to continue executing, and almost always hides a real bug.

Remediation

  • Catch the specific business exception that the operation may throw.

  • Restrict last-resort handlers to Exception or Throwable, and only at the top of a worker thread or request handler — never inside business logic.

References