强化安全问题“未发布的资源流"；用于尝试资源 [英] Fortify security issue "Unreleased resource stream" for try-with-resource

问题描述

加强安全性运行不合规代码

Fortify security run Noncompliant Code

public static A read(String path) throws IOException, ClassNotFoundException {
    try (ObjectInputStream os = new ObjectInputStream(new GZIPInputStream(new FileInputStream(path)))) {
        return (A) os.readObject();
    }
}

它说的是未发布的资源:流"，但是它在try-with-resource内部，那么可能是什么问题?请帮助我.

It is saying "Unreleased Resource: Streams" , but it is inside try-with-resource then what can be the issue? please help me.

推荐答案

您的工具担心的问题是，如果 GZIPInputStream 或 ObjectInputStream 在实例化期间引发异常，那么 FileInputStream 不会关闭.您可以尝试以下操作:

Likely the issue your tool is worried about is if GZIPInputStream or ObjectInputStream throws an exception during instantiation, then the FileInputStream won't be closed. You can try the following:

public static A read(String path) throws IOException, ClassNotFoundException {
    try (FileInputStream fileInput = new FileInputStream(path);
         GZIPInputStream gzipInput = new GZIPInputStream(fileInput);
         ObjectInputStream objectInput = new ObjectInputStream(gzipInput)) {
        return (A) objectInput.readObject();
    }
}

这篇关于强化安全问题“未发布的资源流"；用于尝试资源的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！