Page History

...

A program may leak resources when it relies on finalize() to release system resources or when there is confusion over which part of the program is responsible for releasing system resources. In a busy system, the delay before the finalize() method is called for an object provides a window of vulnerability during which an attacker could induce a denial-of-service attack. Consequently, resources other than raw memory must be explicitly freed in non-finalizer methods , because of the unsuitability of using finalizers. See the rule MET12-J. Do not use finalizers for additional reasons to avoid the use of finalizers.

Note that on the Windows platform, attempts to delete open files fail silently. See rule FIO03-J. Remove temporary files before termination for more information.

...

This noncompliant code example opens a file and uses it , but fails to explicitly close the file.

...

try {
  final FileInputStream stream = new FileInputStream(fileName);
  try {
    final BufferedReader bufRead = new BufferedReader(new InputStreamReader(stream));

    String line;
    while ((line = bufRead.readLine()) != null) {
      sendLine(line);
    }
  } finally {
    if (stream != null) { 
      try {
        stream.close();
      } catch (IOException e) { 
        // forward to handler 
      }
    }
  }
} catch (IOException e) { 
  // forward to handler 
}

Compliant Solution (Java 1.7, try-with-resources)

...

try (FileInputStream stream = new FileInputStream(fileName);
     BufferedReader bufRead = new BufferedReader(new InputStreamReader(stream))) {

  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
} catch (IOException e) { 
  // forward to handler 
}

The try-with-resource resources construct sends any IOException to the catch clause, where it is forwarded to an exception handler. This includes exceptions generated during the allocation of resources (that is, the creation of the FileInputStream or BufferedReader). It also includes any IOException thrown during the while loop. Finally, it includes any IOException generated by closing bufRead or stream.

...

This noncompliant code example attempts to address exhaustion of database connections by adding clean-up code in a finally block. However, either or both of rs and stmt could be null, causing the code in the finally block to throw a NullPointerException.

Statement stmt = null;
ResultSet rs = null
Connection conn = getConnection();
try {
  stmt = conn.createStatement();
  rs = stmt.executeQuery(sqlQuery);
  processResults(rs);
} catch(SQLException e) { 
  // forward to handler  
} finally {
  rs.close();
  stmt.close();
}

...

Statement stmt = null;
ResultSet rs = null;
Connection conn = getConnection();
try {
  stmt = conn.createStatement();
  rs = stmt.executeQuery(sqlQuery);
  processResults(rs);
} catch (SQLException e) { 
  // forward to handler 
} finally {
  if (rs != null) {
    rs.close();
  }
 
  if (stmt != null) {
    stmt.close();
  }
}

...

Statement stmt = null;
ResultSet rs = null;
Connection conn = getConnection();
try {
    stmt = conn.createStatement();
    rs = stmt.executeQuery(sqlQuery);
    processResults(rs);
} catch (SQLException e) { 
  // forward to handler 
} finally {
  if (rs != null) {
    try {
      rs.close();
    } catch (SQLException e) {
      // forward to handler 
    } finally {
      if (stmt != null) {
        try {
          stmt.close();
      } catch (SQLException e) {
        // forward to handler 
      } finally {
        if (conn != null) {
          try {
            conn.close();
          } catch (SQLException e) {
            // forward to handler 
          }
        }
      }
    }
  }
}

Compliant Solution (Java 1.7, try-with-resources)

This compliant solution uses the try-with-resource resources construct, introduced in Java 1.7, to ensure that resources are released as required.

try (Connection conn = getConnection();
     Statement stmt = conn.createStatement();
     ResultSet rs = stmt.executeQuery(sqlQuery)) {

    processResults(rs);
} catch (SQLException e) { 
  // forward to handler 
}

The try-with-resource resources construct sends any SQLException to the catch clause, where it gets forwarded to an exception handler. This includes exceptions generated during the allocation of resources (that is, the creation of the Connection, Statement, or ResultSet). It also includes any SQLException thrown by processResults(). Finally, it includes any SQLException generated by closing rs, stmt, or conn.

...

...

...