CWE-460 抛出异常的清理不恰当

Improper Cleanup on Thrown Exception

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: Medium


The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.


Often, when functions or loops become complicated, some level of resource cleanup is needed throughout execution. Exceptions can disturb the flow of the code and prevent the necessary cleanup from happening.


  • cwe_Nature: ChildOf cwe_CWE_ID: 459 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 755 cwe_View_ID: 1000


Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C#', 'cwe_Prevalence': 'Undetermined'}]


范围 影响 注释
Other Varies by Context The code could be left in a bad state.




If one breaks from a loop or function by throwing an exception, make sure that cleanup happens or that you should exit the program. Use throwing exceptions sparsely.


The following example demonstrates the weakness.

bad Java

public class foo {
public static final void main( String args[] ) {

boolean returnValue;
public static final boolean doStuff( ) {

boolean threadLock;
boolean truthvalue=true;
try {

//check some condition
) {

threadLock=true; //do some stuff to truthvalue
catch (Exception e){

System.err.println("You did something bad");
if (something) return truthvalue;
return truthvalue;

In this case, you may leave a thread locked accidentally.


映射的分类名 ImNode ID Fit Mapped Node Name
CLASP Improper cleanup on thrown exception
The CERT Oracle Secure Coding Standard for Java (2011) ERR03-J Restore prior object state on method failure
The CERT Oracle Secure Coding Standard for Java (2011) ERR05-J Do not let checked exceptions escape from a finally block
SEI CERT Perl Coding Standard EXP31-PL Imprecise Do not suppress or ignore exceptions