CWE-395 (使用NullPointerException捕捉来检测空指针解引用) — Vulnerability Class 2

CWE-395 represents a critical design weakness where developers misuse exception handling to detect null pointer dereferences instead of implementing preventive checks. This anti-pattern typically arises when programmers find catching the resulting NullPointerException easier than fixing the underlying logic flaw, or when they explicitly throw the exception to signal errors. Exploitation occurs when an attacker triggers a null reference, causing the application to catch the exception and potentially expose sensitive stack traces, internal logic, or system states. This leakage aids adversaries in mapping application architecture for further attacks. To avoid this vulnerability, developers must enforce strict null checks before dereferencing pointers. By validating object references proactively rather than reacting to failures, code remains robust, secure, and maintains clear separation between normal control flow and error handling, thereby preventing information disclosure and ensuring stable execution.