Contents
V5008. OWASP. Classes should always be derived from std::exception (and alike) as 'public'.
Note: the diagnostic rule applies only to C++.
The analyzer has detected a class derived from the 'std::exception' class (or similar classes) via the 'private' or 'protected' modifier. Such inheritance is dangerous because it may cause the failed catch of 'std::exception' during the non-public inheritance.
The error may occur if a developer has not specified the inheritance type. According to the language rules, the inheritance is private by default. As a result, exception handlers do not behave as intended.
Here is the incorrect code:
class my_exception_t : std::exception // <=
{
public:
explicit my_exception_t() { }
virtual const int getErrorCode() const throw() { return 42; }
};
....
try
{ throw my_exception_t(); }
catch (const std::exception & error)
{ /* Can't get there */ }
catch (...)
{ /* This code executed instead */ }The code to catch all the standard and user exceptions, like 'catch (const std::exception & error)', cannot work properly because the private inheritance disables the implicit type conversion.
To fix the code, add the 'public' modifier before the 'std::exception' parent class in the list of the base classes:
class my_exception_t : public std::exception
{
....
}This diagnostic is classified as:
|
Was this page helpful?
