CWE-397 is the producer side of the generic exception problem. The product throws or raises overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions.
MITRE lists C++, C#, Java and Python as affected.
How it happens
MITRE gives the Java case: declaring that a method throws Exception or Throwable promotes generic error handling that makes it hard for callers to handle and recover from errors. Java's exception mechanism lets callers anticipate what can go wrong and handle each case, and a generic throws clause defeats that.
public void importFile(Path p) throws Exception {
// can fail in several distinct ways
}
The caller sees only "something may fail" and tends to answer with a generic catch (see CWE-396).
What an attacker gains
MITRE lists non-repudiation: hiding activities, along with altered execution logic. Generic exceptions can hide details about unexpected adversary activity and make error conditions hard to troubleshoot.
How to find it
MITRE says automated static analysis can find some instances. Search method signatures for throws Exception and throws Throwable.
How to fix it
Declare the specific exceptions the method can raise, and raise specific types of your own.
public void importFile(Path p) throws FileNotFoundException, MalformedImportException {
// callers can handle each case separately
}
Quick check
How do CWE-396 and CWE-397 relate?
CWE-397 is the method that throws something too broad. CWE-396 is the caller that catches something too broad. Fixing one makes the other easier to fix.
