CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference

MITRE CWE weakness

Description

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

Programmers typically catch NullPointerException under three circumstances: The program contains a null pointer dereference. Catching the resulting exception was easier than fixing the underlying problem. The program explicitly throws a NullPointerException to signal an error condition. The code is part of a test harness that supplies unexpected input to the classes under test. Of these three circumstances, only the last is acceptable.

Common consequences

• Availability: DoS: Resource Consumption (CPU)

Mitigations

Architecture and Design — Do not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.

References

• CWE page: https://cwe.mitre.org/data/definitions/395.html
• CWE list: https://cwe.mitre.org/data/index.html