Comments (2)
This one is going to be harder to fix than expected. The detector seems to be deeply broken as it's failing on lot of scenarios were it shouldn't.
The database should recognize that closing a Statement
closes the ResultSet
, 'though the opposite is not currently true:
database.addEntry(new MatchMethodEntry(new SubtypeTypeMatcher(BCELUtil.getObjectTypeInstance("java.sql.Statement")),
new ExactStringMatcher("close"), new ExactStringMatcher("()V"), false, ObligationPolicyDatabaseActionType.DEL,
ObligationPolicyDatabaseEntryType.STRONG, statement, resultSet));
database.addEntry(new MatchMethodEntry(new SubtypeTypeMatcher(BCELUtil.getObjectTypeInstance("java.sql.ResultSet")),
new ExactStringMatcher("close"), new ExactStringMatcher("()V"), false, ObligationPolicyDatabaseActionType.DEL,
ObligationPolicyDatabaseEntryType.STRONG, resultSet));
However, this is failing even without the use-with-resources construct:
public class Issue79 {
private static final String QUERY = "";
public void f(Connection cnx) throws SQLException {
PreparedStatement st = null;
ResultSet rs = null;
try {
st = cnx.prepareStatement(QUERY);
rs = st.executeQuery();
while (rs.next()) {
System.out.println(rs.getString("ID"));
}
} finally {
/*
* The statement closes the result set, and there is no scenario where st may be null
* but not the resultset, however an unsatisfied obligation is reported on the resultset
*/
if (st != null) {
st.close();
}
}
}
}
Also of note, the current implementation can't track which result set is associated with which statement, so when using more than one it can produce lots of false positives and false negatives...
We should probably drop this one for release 4.0.0 and think of a deep refactor for this detector.
from spotbugs.
The issue can be reproduced and is confirmed. I'll be working on a fix.
from spotbugs.
Related Issues (20)
- False positive BC_IMPOSSIBLE_INSTANCEOF HOT 4
- Stylesheet not working in 4.8.4 HOT 13
- Signature of eclipse-plugin expired HOT 1
- FP SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR for record HOT 5
- CT_CONSTRUCTOR_THROW: report violation for final fields HOT 2
- Another false positive SING_SINGLETON_IMPLEMENTS_SERIALIZABLE when class is not a singleton (e.g. protobuf) HOT 1
- Array index out of bounds exception on `FindDeadLocalStores` HOT 8
- Index out of bounds for empty switch HOT 3
- spotbugs-4.8.5.zip contains duplicate log4j-core-xxx.jar HOT 1
- False positive with XXE_SCHEMA_FACTORY (and possibly similar rules) when setting properties in separate method HOT 2
- False positive EI_EXPOSE_REP when copyOf or Collections::unmodifiable* is used with Java Record and Optional HOT 3
- False positive EI_EXPOSE_REP when use Collections.emptySet, emptyList or emptyMap is used
- Disable output during Maven goal `spotbugs:check` as redundant with site generation HOT 4
- Asked to end timing for class X but top of stack is class Y remaining stack is [edu.umd.cs.findbugs.log.Profiler HOT 3
- false positive SING_SINGLETON_GETTER_NOT_SYNCHRONIZED with synchronized initialization-method HOT 3
- Facing issues using spotbugs plugin 6.0.19 with Java 17 HOT 2
- Issue during analysis of SpringCGLIB after Spring Boot Native build HOT 13
- Here's a sample code snippet to check if a given string matches a date format HOT 2
- False positive NP_PARAMETER_MUST_BE_NONNULL_BUT_MARKED_AS_NULLABLE when using Nullable annotations with TYPE_USE
- missing close() call not reported in certain cases HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from spotbugs.