CodeQL documentation
CodeQL resources

Ignored error status of call

ID: java/ignored-error-status-of-call
Kind: problem
Security severity: 
Severity: recommendation
Precision: high
Tags:
   - reliability
   - correctness
   - external/cwe/cwe-391
Query suites:
   - java-security-and-quality.qls

Click to see the query in the CodeQL repository

Many methods in the Java Development Kit (for examples, see the references below) return status values (for example, as an int) to indicate whether the method execution finished normally. They may return an error code if the method did not finish normally. If the method result is not checked, exceptional method executions may cause subsequent code to fail.

Recommendation

You should insert additional code to check the return value and take appropriate action.

Example

The following example uses the java.io.InputStream.read method to read 16 bytes from an input stream and store them in an array. However, read may not actually be able to read as many bytes as requested, for example because the stream is exhausted. Therefore, the code should not simply rely on the array b being filled with precisely 16 bytes from the input stream. Instead, the code should check the method’s return value, which indicates the number of bytes actually read.

java.io.InputStream is = (...);
byte[] b = new byte[16];
is.read(b);

References

  • © GitHub, Inc.
  • Terms
  • Privacy