I have recently scanned our code base with Fortify and I'm confused as to why it's flagging certain issues. One issue that I'm facing the issue is with releasing a resource.
Here is a snippet for context.
String someLocation = getPathToTheLocation(); //gives location
try (InputStream in = someLocation == null ? Thread.currentThread().getContextClassLoader()
.getResourceAsStream("someFile.xml") : new FileInputStream(new File(someLocation))) {
/// Do Something
}
Fortify complains that the method that has this try-with-resources block fails to release a system resource allocated by FileInputStream(). Doesn't the try-with-resources help me close the FileInputStream automatically?
Just assuming that Fortify doesn't recognize the try-with-resources paradigm, I refrained from using it and did it the regular way.
String someLocation = getPathToTheLocation(); //gives location
InputStream in = null;
try {
in = someLocation == null ? Thread.currentThread().getContextClassLoader().getResourceAsStream("someFile.xml")
: new FileInputStream(new File(someLocation));
//Do Something.
} finally {
assert in != null;
try {
in.close();
} catch (IOException ioe) {
throw new IllegalStateException("Could not close input stream.", ioe);
}
}
And yet it still complains about the resource being unreleased. What could be the actual issue here that I fail to recognize?