Empty Finally Block

ID

php.empty_finally_block

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

CWE:1071, exception-handling, reliability

Description

Reports finally blocks whose body has no statements. An empty finally block runs no cleanup code, so it adds nothing to the surrounding try construct. A body that contains only comments is also treated as empty, because comments are not executable statements.

Rationale

A finally block exists to run cleanup that must happen whether or not an exception was thrown. An empty one is dead code: it usually means the cleanup was planned but never written, or that earlier cleanup logic was removed and the now-useless block was left behind. In both cases the empty block hides intent and invites the reader to assume cleanup happens when it does not.

<?php
function release($pool): void
{
    try {
        doWork();
    } finally { }                       // FLAW — finally runs no cleanup

    try {
        doWork();
    } finally {
        $pool->close();                 // OK — releases the resource
    }
}

Remediation

If the finally block was meant to release a resource or undo a side effect, add the missing cleanup statement. If no cleanup is needed, remove the finally clause entirely.

References