CWE-395
Use of NullPointerException Catch to Detect NULL Pointer Dereference
Description
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
{"xhtml:p":["Programmers typically catch NullPointerException under three circumstances:","Of these three circumstances, only the last is acceptable."],"xhtml:ul":[{"xhtml:li":["The program contains a null pointer dereference. Catching the resulting exception was easier than fixing the underlying problem.","The program explicitly throws a NullPointerException to signal an error condition.","The code is part of a test harness that supplies unexpected input to the classes under test."]}]}
Parent Weaknesses (ChildOf)
Common Consequences
Scope
Impact
DoS: Resource Consumption (CPU)
Potential Mitigations
Do not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.
Applicable Platforms
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now