← 返回首页
Ignored error status of call — CodeQL query help documentation CodeQL docs
CodeQL documentation
CodeQL resources

Ignored error status of call

ID: java/ignored-error-status-of-call Kind: problem Security severity: Severity: recommendation Precision: high Tags: - quality - reliability - error-handling - external/cwe/cwe-391 Query suites: - java-code-quality.qls - java-security-and-quality.qls

Click to see the query in the CodeQL repository

Many methods in the Java Development Kit (for examples, see the references below) return status values (for example, as an int) to indicate whether the method execution finished normally. They may return an error code if the method did not finish normally. If the method result is not checked, exceptional method executions may cause subsequent code to fail.

Recommendation

You should insert additional code to check the return value and take appropriate action.

Example

The following example uses the java.io.InputStream.read method to read 16 bytes from an input stream and store them in an array. However, read may not actually be able to read as many bytes as requested, for example because the stream is exhausted. Therefore, the code should not simply rely on the array b being filled with precisely 16 bytes from the input stream. Instead, the code should check the method’s return value, which indicates the number of bytes actually read.

java.io.InputStream is = (...); byte[] b = new byte[16]; is.read(b);

References