Java 未发布资源：流

嗨，freinds，我在防御报告中收到以下代码的警告：

 if (null != serverSocket) {

     OutputStream socketOutPutStream = serverSocket
       .getOutputStream();
     if (null != socketOutPutStream) {

      oos = new ObjectOutputStream(socketOutPutStream);
      if (null != oos) {
       int c;
       log.info("i am in Step 3 ooss " + oos);
       while ((c = mergedIS.read()) != -1) {
        oos.writeByte(c);
       }
      }
      log.info("i am in Step 4 ");

     }

    }

在catch block中，我已经提到：

catch (UnknownHostException e) {
    //catch exception Vibhas added 
    log.info("UnknownHostException occured");

   } catch (IOException e) {
    //catch exception Vibhas added
    log.info("IOException occured");

   } catch (Exception e) {
    //catch exception
    //log.info("error occured in copyFile in utils-->"+e.getMessage()+"file name is-->"+destiFileName);
   }finally{

    if (null != oos){

     oos.flush();
     oos.close();

      }
      catch (Exception e) {
     //catch exception
      }

    }

我在强化报告中得到的警告是：

Abstract: The function copyFile() in ODCUtil.java sometimes fails to release a system resource
allocated by getOutputStream() on line 61.
Sink: ODCUtil.java:64 oos = new ObjectOutputStream(socketOutPutStream)()
62 if (null != socketOutPutStream) {
63
64 oos = new ObjectOutputStream(socketOutPutStream);
65 if (null != oos) {
66 int c;

完整代码：

public boolean copyFile(InputStream is, String destiFileName) {
    boolean flag = false;
    {
        InputStream mergedIS = null;
        ObjectOutputStream oos = null;
        ObjectInputStream ois = null;
        ByteArrayInputStream str = null;
        try {

            //Step 1 : first get the input stream of file content and file name
            // then merge into one input stream
            log.info("i am in Step 1 ");
            log.info("destiFileName got-->" + destiFileName);
            log.info("is  got in coptFile function -->" + is);
            destiFileName = "@" + destiFileName + "@";
            log.info("destiFileName sending to server-->" + destiFileName);
            str = new ByteArrayInputStream(destiFileName.getBytes());
            log.info("The ByteArrayInputStream we got is  "
                    + str.toString());
            mergedIS = new SequenceInputStream(str, is);

            //Step 2 : Make a connection to server ie DB server
            log.info("i am in Step 2 ");
            String serverIP = "172.17.119.67";
            int serverPort = 1522;
            Socket serverSocket = new Socket(serverIP, serverPort);

            //Step 3 : We have to write the merged inputstream to outputstream of server, ie socket of server
            log.info("i am in Step 3 ");

            //added by vibhas to resolve Unreleased resource

            if (null != serverSocket) {

                OutputStream socketOutPutStream = serverSocket
                        .getOutputStream();
                if (null != socketOutPutStream) {

                    oos = new ObjectOutputStream(socketOutPutStream);
                    if (null != oos) {
                        int c;
                        log.info("i am in Step 3 ooss " + oos);
                        while ((c = mergedIS.read()) != -1) {
                            oos.writeByte(c);
                            socketOutPutStream.close();
                        }
                    }
                    log.info("i am in Step 4 ");

                }

            }

            //Step 4 : We have to get an acknowledgment from server that , server has copied the file properly
            //this is the same .

            if (true) {
                log.info("i am in Step 4 11");
                flag = true;
            }
        } catch (UnknownHostException e) {
            //catch exception Vibhas added 
            log.info("UnknownHostException occured");

        } catch (IOException e) {
            //catch exception Vibhas added
            log.info("IOException occured");

        } catch (Exception e) {
            //catch exception
            //log.info("error occured in copyFile in utils-->"+e.getMessage()+"file name is-->"+destiFileName);
        } finally {
            try {
                if (null != str) {
                    str.close();
                }
                if (null != ois) {
                    ois.close();
                }
                if (null != mergedIS) {
                    mergedIS.close();
                }
                if (null != oos) {
                    oos.flush();
                    oos.close();
                }
            } catch (Exception e) {
                //catch exception
            }
        }
    }
    log.info("finally returned flag-->" + flag);
    return flag;
}

---

我不知道什么是强化报告，但您在哪里关闭

socketOutPutStream

？关闭

oos

的副作用是否会导致关闭？即使如此，

socketOutPutStream

也可能不是

null

，需要关闭，但

oos

为null

不是一个好的尝试/捕获结构。首先，问问自己： 如果

str.close（）（在
最后
块的开头）引发异常

最好看这里：

顺便说一句：这很难看
new
将永远不会返回
null

  oos = new ObjectOutputStream(socketOutPutStream);
  if (null != oos) {

BTW2:您确定需要
ObjectOutputStream
？很多人用它来写普通字节，但这不是想法（它是用来序列化对象的），而原始的OutputStream就足以做到这一点。
好吧，对你来说可能太晚了，但我有一个想法。在
finally
块中，在调用
close（）
之前调用
flush（）
。但是
flush（）
 请粘贴完整的代码片段，正确缩进。要么上述代码未编译（oos.close的catch没有匹配的try块），要么缩进太混乱。有没有解决方案？Hi-Hemal Fortify Report用于检查代码的易受攻击性，以防任何类型的攻击（专门用于安全测试）。我已关闭socketOutPutStream，但仍然遇到相同的问题。我在这里把完整的代码放在这里，这样你就可以提出建议。如何最终阻止一个异常，所有的异常都是在控件进入最终阻止之前处理的。我还在str.close语句之前检查空条件。请澄清。另外，请解释为什么在我之前的代码中提到了未发布资源的情况。我同意新操作符不会返回null。谢谢你的建议。在try块中，你正在几个obejct上调用cloase。如果其中任何一个抛出异常，则不会为其余对象调用close。尝试将每个关闭包装在单独的Try{…close（）；}catch{..}