Skip to content

Latest commit

 

History

History
90 lines (64 loc) · 4.5 KB

ca2102.md

File metadata and controls

90 lines (64 loc) · 4.5 KB
title description ms.date ms.topic f1_keywords helpviewer_keywords author ms.author manager ms.subservice monikerRange
CA2102: Catch non-CLSCompliant exceptions in general handlers
A member in an assembly that is not marked with the System.Runtime.CompilerServices.RuntimeCompatibilityAttribute or is marked RuntimeCompatibility(WrapNonExceptionThrows = false) contains a catch block that handles System.Exception and does not contain an immediately following general catch block.
11/04/2016
reference
CA2102
CatchNonClsCompliantExceptionsInGeneralHandlers
CA2102
mikejo5000
mikejo
mijacobs
code-analysis
vs-2019

CA2102: Catch non-CLSCompliant exceptions in general handlers

Item Value
RuleId CA2102
Category Microsoft.Security
Breaking change Non-breaking

Cause

A member in an assembly that is not marked with the xref:System.Runtime.CompilerServices.RuntimeCompatibilityAttribute or is marked RuntimeCompatibility(WrapNonExceptionThrows = false) contains a catch block that handles xref:System.Exception?displayProperty=fullName and does not contain an immediately following general catch block. This rule ignores Visual Basic assemblies.

Note

This rule has been deprecated. For more information, see Deprecated rules.

Rule description

A catch block that handles xref:System.Exception catches all Common Language Specification (CLS) compliant exceptions. However, it does not catch non-CLS compliant exceptions. Non-CLS compliant exceptions can be thrown from native code or from managed code that was generated by the Microsoft intermediate language (MSIL) Assembler. Notice that the C# and Visual Basic compilers do not allow non-CLS compliant exceptions to be thrown and Visual Basic does not catch non-CLS compliant exceptions. If the intent of the catch block is to handle all exceptions, use the following general catch block syntax.

  • C#: catch {}

  • C++: catch(...) {} or catch(Object^) {}

An unhandled non-CLS compliant exception becomes a security issue when previously allowed permissions are removed in the catch block. Because non-CLS compliant exceptions are not caught, a malicious method that throws a non-CLS compliant exception could run with elevated permissions.

How to fix violations

To fix a violation of this rule when the intent is to catch all exceptions, substitute or add a general catch block or mark the assembly RuntimeCompatibility(WrapNonExceptionThrows = true). If permissions are removed in the catch block, duplicate the functionality in the general catch block. If it is not the intent to handle all exceptions, replace the catch block that handles xref:System.Exception with catch blocks that handle specific exception types.

When to suppress warnings

It is safe to suppress a warning from this rule if the try block does not contain any statements that might generate a non-CLS compliant exception. Because any native or managed code might throw a non-CLS compliant exception, this requires knowledge of all code that can be executed in all code paths inside the try block. Notice that non-CLS compliant exceptions are not thrown by the common language runtime.

Example 1

The following example shows an MSIL class that throws a non-CLS compliant exception.

.assembly ThrowNonClsCompliantException {}
.class public auto ansi beforefieldinit ThrowsExceptions
{
   .method public hidebysig static void
         ThrowNonClsException() cil managed
   {
      .maxstack  1
      IL_0000:  newobj     instance void [mscorlib]System.Object::.ctor()
      IL_0005:  throw
   }
}

Example 2

The following example shows a method that contains a general catch block that satisfies the rule.

:::code language="csharp" source="../snippets/csharp/VS_Snippets_CodeAnalysis/FxCop.Security.CatchNonClsCompliantException/cs/FxCop.Security.CatchNonClsCompliantException.cs" id="Snippet1":::

Compile the previous examples as follows.

ilasm /dll ThrowNonClsCompliantException.il
csc /r:ThrowNonClsCompliantException.dll CatchNonClsCompliantException.cs

Related rules

CA1031: Do not catch general exception types

See also