Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: FIO14-J: files closed properly, in accordance with FIO04J

...

Code Block
bgColor#ccccff
public class CreateFile {
  public static void main(String[] args) throws FileNotFoundException {
    final PrintStream out = new PrintStream(new BufferedOutputStream(
 new FileOutputStream("foo.txt")));
    try {
      out.println("hello");
    } finally {
      out.close();
    }
           new FileOutputStream("foo.txt")));
    out.println("hello");
    out.close();
    Runtime.getRuntime().exit(1);
  }
}
Runtime.getRuntime().exit(1);
  }
}

Compliant Solution (Shutdown Hook)

...

Code Block
bgColor#FFcccc
public class InterceptExit {
  public static void main(String[] args) throws FileNotFoundException {
    InputStream in = null;
    try {
      in = new FileInputStream("file");
    try {
      System.out.println("Regular code block");
      // Abrupt exit such as ctrl + c key pressed
      System.out.println("This never executes");
    } finally {
      if in.close();  // this never executes either
(in != null) {
        try }{
  }
}

Compliant Solution (addShutdownHook())

        in.close();  // this never executes either
        } catch (IOException x) {
          // handle error
        }
      }
    }
  }
}

Compliant Solution (addShutdownHook())

Use the addShutdownHook() Use the addShutdownHook() method of java.lang.Runtime to assist with performing clean-up operations in the event of abrupt termination. The JVM starts the shutdown hook thread when abrupt termination is initiated; the shutdown hook runs concurrently with other JVM threads.

...

  • be light-weight and simple
  • be thread safe
  • hold locks when accessing data and release those locks when done
  • unmigrated-wiki-markup
    lack reliance on system services, as the services themselves may be shutting down (for example, the logger may shutdown from another hook). Instead of one service it may be better to run a series of shutdown tasks from one thread by using a single shutdown hook \[[Goetz 2006|AA. Bibliography#Goetz 06]\].

This compliant solution shows the standard method to install a hook.

  • markup
    lack reliance on system services, as the services themselves may be shutting down (for example, the logger may shutdown from another hook). Instead of one service it may be better to run a series of shutdown tasks from one thread by using a single shutdown hook \[[Goetz 2006|AA. Bibliography#Goetz 06]\].

This compliant solution shows the standard method to install a hook.

Code Block
bgColor#ccccff

public class Hook {

  public static void main(String[] args) {
    try {
      final InputStream in = new FileInputStream("file");
        Runtime.getRuntime().addShutdownHook(new Thread() {
          public void run() {
            // Log shutdown and close all resources
            in.close();
          }
Code Block
bgColor#ccccff

public class Hook {

  public static void main(String[] args) {
    final InputStream in = new FileInputStream("file");
    Runtime.getRuntime().addShutdownHook(new Thread() {
      public void run() {
        // Log shutdown and close all resources
  });

       // ...
   } catch  in.close();
(IOException x) {
     // handle }error
    });
		
} catch (FileNotFoundException x) {
     // handle ...error
  }
}

The JVM can abort for external reasons, such as an external SIGKILL signal (UNIX) or the TerminateProcess call (Microsoft Windows), or memory corruption caused by native methods. Shutdown hooks may fail to execute as expected in such cases, because the JVM cannot guarantee that they will be executed as intended.

...

The CERT C Secure Coding Standard

ERR04-C. Choose an appropriate termination strategy

The CERT C++ Secure Coding Standard

ERR04-CPP. Choose an appropriate termination strategy

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="39ab3cd207c73dd4-9e6d638f-439f4f36-8d2fa888-2146ba8397844dc1d1e9f9b4"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Termination Strategy [REU]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE ID 705, "Incorrect Control Flow Scoping"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="52e00c75e5f31f1d-21a7fd02-4fdb46b0-8476bbed-905924eef0e15e1300d85077"><ac:plain-text-body><![CDATA[

[[API 06

AA. Bibliography#API 06]]

[Class Runtime

http://download.oracle.com/javase/6/docs/api/java/lang/Runtime.html]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b25632feb6d40ba1-6a77ff5f-4a114933-b505a9cd-9c807c218adfadee0e3f209d"><ac:plain-text-body><![CDATA[

[[ISO/IEC TR 24772:2010

AA. Bibliography#ISO/IEC TR 24772-2010]]

Section 6.46, "Termination Strategy [REU]"

]]></ac:plain-text-body></ac:structured-macro>

...