>
>
>
V5008. OWASP. Classes should always be …


V5008. OWASP. Classes should always be derived from std::exception (and alike) as 'public'.

Note: the diagnostic rule applies only to C++.

The analyzer has detected a class derived from the 'std::exception' class (or similar classes) via the 'private' or 'protected' modifier. Such inheritance is dangerous because it may cause the failed catch of 'std::exception' during the non-public inheritance.

The error may occur if a developer has not specified the inheritance type. According to the language rules, the inheritance is private by default. As a result, exception handlers do not behave as intended.

Here is the incorrect code:

class my_exception_t : std::exception // <=
{
public:
  explicit my_exception_t() { }
  virtual const int getErrorCode() const throw() { return 42; }
};
....
try
  { throw my_exception_t(); }
catch (const std::exception & error)
  { /* Can't get there */ }
catch (...)
  { /* This code executed instead */ }

The code to catch all the standard and user exceptions, like 'catch (const std::exception & error)', cannot work properly because the private inheritance disables the implicit type conversion.

To fix the code, add the 'public' modifier before the 'std::exception' parent class in the list of the base classes:

class my_exception_t : public std::exception
{
  ....
}

This diagnostic is classified as: