Empty Catch Block

ID

php.empty_catch_block

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

CWE:1069, exception-handling, reliability

Description

Reports catch clauses whose body has no statements. A catch block that contains nothing silently swallows the exception, so the failure leaves no trace and the program keeps running in an unexpected state. A body that contains only comments is also treated as empty, because comments are not executable statements.

Rationale

Swallowing an exception with an empty catch block destroys the diagnostic information that would let a developer or an operator understand what went wrong. The program continues as if nothing happened, often producing incorrect results far away from the real cause and turning a clear failure into a hard-to-trace bug. If a failure really is expected and harmless, the handler should still say so explicitly with a log entry or a documented action.

<?php
function process(): void
{
    try {
        doWork();
    } catch (RuntimeException $e) { }            // FLAW — exception is silently swallowed

    try {
        doWork();
    } catch (Exception $e) {
        error_log($e->getMessage());            // OK — failure is recorded
    }
}

Remediation

Handle the exception meaningfully: log it, rethrow it (optionally wrapped), or take a documented recovery action. If the failure is genuinely expected and safe to ignore, add an explicit statement that records the decision so the intent is clear to the next reader.

References