# V5008. OWASP. Classes should always be derived from std::exception (and alike) as 'public'.

Note: the diagnostic rule applies only to C++.

The analyzer has detected a class derived from the 'std::exception' class (or similar classes) via the 'private' or 'protected' modifier. Such inheritance is dangerous because it may cause the failed catch of 'std::exception' during the non-public inheritance.

The error may occur if a developer has not specified the inheritance type. According to the language rules, the inheritance is private by default. As a result, exception handlers do not behave as intended.

Here is the incorrect code:

    class my_exception_t : std::exception // <=
    {
    public:
      explicit my_exception_t() { }
      virtual const int getErrorCode() const throw() { return 42; }
    };
    ....
    try
      { throw my_exception_t(); }
    catch (const std::exception & error)
      { /* Can't get there */ }
    catch (...)
      { /* This code executed instead */ }

The code to catch all the standard and user exceptions, like 'catch (const std::exception & error)', cannot work properly because the private inheritance disables the implicit type conversion.

To fix the code, add the 'public' modifier before the 'std::exception' parent class in the list of the base classes:

    class my_exception_t : public std::exception
    {
      ....
    }

This diagnostic is classified as:

CWE-544 OWASP-7.4.2