Closed salsolatragus closed 6 years ago
I agree that we haven't seen any misuses related to missing throws or throwing wrong exceptions. However, it does not mean that it should not be there. As long as it is a reasonable part of a usage, we should capture it. We should only limit/remove things when we encounter problems, e.g., scalability, false positives, etc.,
Yeah... I guess you're right, it doesn't hurt to have them as long is it doesn't hurt to have them ;)
I'm currently working on a more detailed description of AUGs and I stumbled across
throw
action nodes. Why do we need those in the context of misuse detection? I see that they are somehow similar toreturn
nodes. These we have to capture that returned values are somehow used (as opposed to dropped). One could say we havethrow
nodes also to encode that exception objects are somehow used, but this seems less interesting...For both types of action nodes, we don't use them to encode control flow, right? The control flow is entirely translated into edges, e.g., when an
if
guards areturn
/throw
we add control edges from its condition to everything below thereturn
/throw
.