FinallyThrowMasksException

warning native off by default PHP ≥ 5.5

Group: Probable bugs

An exception thrown during final cleanup can replace the exception already being propagated. Preserve the original failure when reporting cleanup errors. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
try { throw new RuntimeException("a"); } finally { throw new LogicException("b"); }

Reported:

• line 2: Preserve the original exception during cleanup.

Detection

• A try body ends with an unconditional explicit throw, and its finally block also ends with an unconditional explicit throw; neither throw is caught inside its own block. Highlight the finally throw.
• The original try exception must remain unhandled when entering finally. Exclude a try statement with a catch that handles that thrown exception, including a catch that returns normally; conservative unsupported catch relationships discard the propagating-exception proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Requires PHP 5.5 or later.

Configure

In custos.json:

{
  "rules": {
    "FinallyThrowMasksException": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore FinallyThrowMasksException