No Catch Generic Exception

ID

kotlin.no_catch_generic_exception

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

Kotlin

Tags

CWE:396, catch, exception

Description

Reports catch clauses that capture the broadest exception super-types: Exception, Throwable or RuntimeException. These umbrella catches swallow unrelated failures (programming errors, security exceptions, infrastructure failures) that the catching code is rarely prepared to handle.

Rationale

// Bad — swallows everything
try { ... } catch (e: Exception) { ... }                      // FLAW
try { ... } catch (e: Throwable) { ... }                      // FLAW
try { ... } catch (e: RuntimeException) { ... }               // FLAW
try { ... } catch (e: java.lang.Exception) { ... }            // FLAW

// OK — specific exception the operation may throw
try { ... } catch (e: IllegalStateException) { ... }
try { ... } catch (e: IOException) { ... }

Generic catches mask bugs, hide cause-and-effect, and frequently leave the application in an inconsistent state.

Remediation

  • Catch the specific exception(s) the operation may actually throw.

  • If a last-resort handler is needed, place it at the very top of a worker thread or request handler — never inside business logic.

  • Consider rethrowing or wrapping the exception with a more specific type that callers can reason about.

References