Dropped Exception

ID

php.dropped_exception

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

CWE:391, error-handling, reliability

Description

Reports a catch clause that declares an exception variable which is never referenced anywhere inside its (non-empty) body. The caught exception is effectively dropped: it is neither inspected, logged, nor rethrown.

Rationale

When the catch variable is never read, the failure is silently swallowed and the program carries on as if nothing happened — usually in a broken state and with no trace of the original error. At minimum a caught exception should be logged, rethrown (optionally wrapped), or its message surfaced to the caller. Completely empty catch bodies are reported separately, and catches that clearly signal intent to ignore — a variable named _ or beginning with ignore, or a body that emits a log or console message — are tolerated by default (configurable via omitIgnored).

<?php
try {
    $this->step();
} catch (\RuntimeException $e) {   // FLAW — $e is never used, failure is swallowed
    $this->recover();
}

try {
    $this->step();
} catch (\RuntimeException $e) {   // OK — exception is rethrown
    throw $e;
}

Remediation

Use the caught exception: log it, surface its message, or rethrow it (wrapping it as the previous exception when raising a new type). If the failure really is safe to ignore, make the intent explicit by naming the variable ignored or recording the reason with a log call so the swallowing is deliberate and visible.

References