Java - squid:S2095 - False positive when returning a BufferedInputStream

[Vincent Privat]

Hi,

We have this method which triggers S2095 (Close this "InputStream"):

				public InputStream getInputStream(String uriStr) throws IOException {
				File file = getFile(uriStr);
				if (file != null) {
				try {
				return new BufferedInputStream(Compression.getUncompressedFileInputStream(file)); InputStream is never closed. Close this "InputStream".   il y a 4 jours    L205        Bug     Blocker     Open    Not assigned    5min effort   Comment  cert, cwe, denial-of-service, leak
				} catch (FileNotFoundException e) {
				throw new IOException(tr("File ''{0}'' does not exist.", file.getPath()), e);
				}
				} else if (inZipPath != null) {
				ZipEntry entry = zipFile.getEntry(inZipPath);
				if (entry != null) {
				return zipFile.getInputStream(entry);
				}
				}
				throw new IOException(tr("Unable to locate file ''{0}''.", uriStr));
				}

The warning concerns the inner stream passed to BufferedInputStream. But as BufferedInputStream.close() will close it, it seems to be a false positive.

Best regards,

Vincent

[Tibor Blenessy]

Hello Vincent,

which version of SonarJava analyzer are you using? We fixed some issues for this rule recently, if possible try to upgrade to the latest version and check if you still have the issue.

Best regards

Tibor

--
You received this message because you are subscribed to the Google Groups "SonarQube" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sonarqube+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/1bd37b8f-b573-49fe-a353-525a05915407%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Tibor Blenessy | SonarSource

SonarJava Developer

http://sonarsource.com 

[Vincent Privat]

Hi Tibor,

I don't remember what version we had when I reported the issue but it seems to be gone in 4.9 :)

Thanks !