Ignored error status of call¶
ID: java/ignored-error-status-of-call Kind: problem Severity: recommendation Precision: high Tags: - reliability - correctness - external/cwe/cwe-391 Query suites: - java-security-and-quality.qls
Many methods in the Java Development Kit (for examples, see the references below) return status values (for example, as an
int) to indicate whether the method execution finished normally. They may return an error code if the method did not finish normally. If the method result is not checked, exceptional method executions may cause subsequent code to fail.
You should insert additional code to check the return value and take appropriate action.
The following example uses the
java.io.InputStream.read method to read 16 bytes from an input stream and store them in an array. However,
read may not actually be able to read as many bytes as requested, for example because the stream is exhausted. Therefore, the code should not simply rely on the array
b being filled with precisely 16 bytes from the input stream. Instead, the code should check the method’s return value, which indicates the number of bytes actually read.
java.io.InputStream is = (...); byte b = new byte; is.read(b);
SEI CERT Oracle Coding Standard for Java: EXP00-J. Do not ignore values returned by methods.
Java API Specification: java.util.Queue.offer.
Java API Specification: java.util.concurrent.BlockingQueue.offer.
Common Weakness Enumeration: CWE-391.