try { 
    //code to do  IO operations 
    return var1; 
} Catch(Exception e) { 
    return var2; 
} finally{ 
    return var3; 
} 

From security view point problem with above code is

Returning in a finally block is problematic because it discards any exception that was thrown in the try/catch blocks and overrides return values from both try and catch. This can hide security-relevant exceptions. Catching the generic Exception instead of specific exceptions is also a security anti-pattern that can mask error conditions.