首页 \ 问答 \ JDBC，Fortify和Try-With-Resource(JDBC, Fortify and Try-With-Resource)

JDBC，Fortify和Try-With-Resource(JDBC, Fortify and Try-With-Resource)

 我目前正在使用HP的Fortify SCA工具来解决代码库中的安全问题。 我在确定正确处理JDBC资源的最佳方法时遇到了一些问题。 
 

 我现在的代码看起来像这样; 
 

    try (Connection conn = new DatabaseService().getConnection();
            PreparedStatement ps = conn.prepareStatement(query);) {

        ps.setString(1, mString);

        try (ResultSet rs = ps.executeQuery();) {

            while (rs.next()) {
             ...Do logic...
            }

        } catch (SQLException e) {
            e.printStackTrace();
        }

    } catch (SQLException e){
        e.printStackTrace();
    }
}

 

 问题是Fortify将标记此代码，指出如果在嵌套的try语句中发生异常，则对conn和ps的引用将丢失，并且它们将无法正确关闭。 是强制正确标记这个还是假阳性？ 根据我的理解，try-with-resource 应该总是关闭他们的资源，但是当他们像这样嵌套时，这并不总是会发生。 
 

 我已经浏览了互联网上的其他相关问题和博客，但我还没有得到任何明确的证据。 
 

 在这种情况下始终安全的文档最多的解决方案是不使用try-with-resource并在更广泛的try-catch语句的catch和finally块中使用try-catch包装每个资源。 但是，我宁愿避免这种情况，因为它非常冗长。 
 

 提前致谢！ 
 

 编辑：所以当我重新写入SO时，我意识到我已经从代码中遗漏了一些东西。 原始的catch块有一个System.exit(1); 他们的陈述（我知道的坏习惯）。 这意味着如果在嵌套的try-with-resource中抛出异常，那么Fortify就可以说conn和ps不会被正确关闭。 
 

 感谢回复，没有System.exit(1); 这种情况下的所有资源都将被正确关闭，我选择了答案表明。 

I'm currently working through a project that is using HP's Fortify SCA tool to catch security issues in the code base. I'm having a bit of issue determining the best approach to correctly handling JDBC resources. 
 

The code I have at the minute looks like this;
 

    try (Connection conn = new DatabaseService().getConnection();
            PreparedStatement ps = conn.prepareStatement(query);) {

        ps.setString(1, mString);

        try (ResultSet rs = ps.executeQuery();) {

            while (rs.next()) {
             ...Do logic...
            }

        } catch (SQLException e) {
            e.printStackTrace();
        }

    } catch (SQLException e){
        e.printStackTrace();
    }
}

 

The problem is that Fortify will flag this code stating that if an exception were to happen in the nested try statement then the reference to conn and ps will be lost and they won't be properly closed. Is fortify correct to flag this or is it a false positive? From what I understand try-with-resource should always close their resource but perhaps this doesn't always happen when they're nested like this.
 

I've scoured other related questions and blogs around the internet but I haven't been able to get any definitive proof on this. 
 

The most documented solution that's always safe in this situation is to not use try-with-resource and wrap each resource with a try-catch in both the catch and finally blocks of a broader try-catch statement. However, I'd rather avoid this because it's horribly verbose.
 

Thanks in advance!
 

Edit: So I realized I've left something out of the code when I was re-writing it into SO. The original catch blocks had a System.exit(1); statement in them (bad practice I know). That would mean that if an exception was thrown in the nested try-with-resource then Fortify would be correct to say the conn and ps would not be properly closed. 
 

Thanks for the replies, without the System.exit(1); all resources in this situation will be closed properly and I've selected the answer indicating that.

原文：https://stackoverflow.com/questions/34139717
更新时间：2023-12-12 13:12

最满意答案

 将您的4个Paths分组到一个Grid然后将该Grid放入一个应按您想要的方式缩放的Viewbox 。 
 

<Viewbox Stretch="Fill" HorizontalAlignment="Left" Height="125.96" VerticalAlignment="Top" Width="127">
        <Grid>
            <Path Fill="#ff221e1f" Data="F1 M 65.778,45.310 L 85.092,45.310 L 85.092,47.630 L 68.504,47.630 L 68.504,63.174 L 83.700,63.174 L 83.700,65.494 L 68.504,65.494 L 68.504,84.402 L 65.778,84.402 L 65.778,45.310 Z"/>
            <Path Fill="#ff221e1f" Data="F1 M 95.300,64.218 L 101.505,64.218 C 107.538,64.218 111.482,60.854 111.482,55.692 C 111.482,49.718 107.074,47.282 100.926,47.282 C 98.257,47.282 96.286,47.572 95.300,47.804 L 95.300,64.218 Z M 92.574,45.832 C 94.952,45.310 98.316,45.020 100.984,45.020 C 106.087,45.020 109.278,46.122 111.540,48.268 C 113.222,49.892 114.266,52.502 114.266,55.228 C 114.266,60.506 111.133,63.870 106.610,65.436 L 106.610,65.552 C 109.742,66.538 111.713,69.496 112.642,73.846 C 113.976,79.936 114.730,82.836 115.542,84.402 L 112.642,84.402 C 112.062,83.242 111.192,79.820 110.148,74.890 C 108.988,69.264 106.551,66.712 101.390,66.480 L 95.300,66.480 L 95.300,84.402 L 92.574,84.402 L 92.574,45.832 Z"/>
            <Path StrokeThickness="3.0" Stroke="#ff221e1f" StrokeStartLineCap="Round" StrokeEndLineCap="Round" StrokeLineJoin="Round" Data="F1 M 179.125,90.312 C 179.125,139.362 139.362,179.125 90.312,179.125 C 41.263,179.125 1.500,139.362 1.500,90.312 C 1.500,41.263 41.263,1.500 90.312,1.500 C 139.362,1.500 179.125,41.263 179.125,90.312 Z"/>
            <Path StrokeThickness="3.0" Stroke="#ff221e1f" StrokeStartLineCap="Round" StrokeEndLineCap="Round" StrokeLineJoin="Round" Data="F1 M 75.533,117.798 L 103.986,117.798"/>
        </Grid>
    </Viewbox>

 

 您可能希望在将Grid放入Viewbox之前，将Grid更接近路径的实际大小。 
 

这是我在Blend中得到的

Group your 4 Paths into a Grid then put that Grid into a Viewbox that should scale the way you want.
 

<Viewbox Stretch="Fill" HorizontalAlignment="Left" Height="125.96" VerticalAlignment="Top" Width="127">
        <Grid>
            <Path Fill="#ff221e1f" Data="F1 M 65.778,45.310 L 85.092,45.310 L 85.092,47.630 L 68.504,47.630 L 68.504,63.174 L 83.700,63.174 L 83.700,65.494 L 68.504,65.494 L 68.504,84.402 L 65.778,84.402 L 65.778,45.310 Z"/>
            <Path Fill="#ff221e1f" Data="F1 M 95.300,64.218 L 101.505,64.218 C 107.538,64.218 111.482,60.854 111.482,55.692 C 111.482,49.718 107.074,47.282 100.926,47.282 C 98.257,47.282 96.286,47.572 95.300,47.804 L 95.300,64.218 Z M 92.574,45.832 C 94.952,45.310 98.316,45.020 100.984,45.020 C 106.087,45.020 109.278,46.122 111.540,48.268 C 113.222,49.892 114.266,52.502 114.266,55.228 C 114.266,60.506 111.133,63.870 106.610,65.436 L 106.610,65.552 C 109.742,66.538 111.713,69.496 112.642,73.846 C 113.976,79.936 114.730,82.836 115.542,84.402 L 112.642,84.402 C 112.062,83.242 111.192,79.820 110.148,74.890 C 108.988,69.264 106.551,66.712 101.390,66.480 L 95.300,66.480 L 95.300,84.402 L 92.574,84.402 L 92.574,45.832 Z"/>
            <Path StrokeThickness="3.0" Stroke="#ff221e1f" StrokeStartLineCap="Round" StrokeEndLineCap="Round" StrokeLineJoin="Round" Data="F1 M 179.125,90.312 C 179.125,139.362 139.362,179.125 90.312,179.125 C 41.263,179.125 1.500,139.362 1.500,90.312 C 1.500,41.263 41.263,1.500 90.312,1.500 C 139.362,1.500 179.125,41.263 179.125,90.312 Z"/>
            <Path StrokeThickness="3.0" Stroke="#ff221e1f" StrokeStartLineCap="Round" StrokeEndLineCap="Round" StrokeLineJoin="Round" Data="F1 M 75.533,117.798 L 103.986,117.798"/>
        </Grid>
    </Viewbox>

 

You might want to size the Grid down closer to your paths' real size before putting it in a Viewbox.
 

Here's what I get in Blend

相关问答

更多

  • requirejs多个路径一个库(requirejs multiple paths one library)[2022-09-06]

    这听起来像地图配置是一种更好的方法。 如果您的模块需要'ko'但其他模块需要'淘汰'，那么只需将'ko'映射到模块的'knockout'即可。 require.config({ paths: { 'knockout': '../Lib/knockout-2.1.0.debug', }, map: { '*': { 'ko': 'knockout' } } }); 如果只有某些模块名称需要重新映射，请在上面的示例中将“*”替换为模块名称。 或者 ...

  • 均匀分布的数字在[-1,1]，[ - 2,2]等范围内(Uniformly distributed numbers within a range of [-1,1], [-2,2] and so on)[2022-02-16]

    包括： #include #include 在开始的某个地方需要： srand(time(NULL)); 功能： double Rand(double min, double max) { return rand() / (double)(RAND_MAX - 1) * (max - min) + min; } 所以你可以这样称呼： Rand(-2, 2); 或者做另一个功能： double Rand (double limit) { retu ...

  • 如何拉伸物体？(How to stretch an object?)[2023-04-11]

    运行此代码，它将适合您： self.map.frame = CGRect(x: map.frame.origin.x, y: map.frame.origin.y, width: map.frame.width, height: map.frame.height + 50) Run this code and it will work for you: self.map.frame = CGRect(x: map.frame.origin.x, y: map.frame.origin.y, width: ...

  • 如何适当地拉伸与非细节带溢出(How to properly stretch with overflow for non-detail band [duplicate])[2023-11-10]

    您可以尝试以下这些文本属性： - 对于标题带的第一个字段（收银员名称），请使用以下属性： - Position Type- Fix Relative to Top Stretch Type- Relative to Band Height Stretch With Overflow - true 对于第二个字段（日期）设置这些属性 Position Type- Fix Relative to Bottom Stretch Type- ...

  • 每个人的多个登录路径(Multiple login paths for everyauth)[2021-06-06]

    结束使用： https ： //npmjs.org/package/connect-modrewrite 这是我的示例的一些示例代码： app.use(modRewrite([ '/v1/login /login', '/v1/logout /logout' ])) Ended up using this: https://npmjs.org/package/connect-modrewrite Here's some sample code for my example: app.u ...

  • 如何在一行中添加多个SEARCH_PATHS？(How to add multiple SEARCH_PATHS in one line?)[2024-02-01]

    尝试这个： HEADER_SEARCH_PATHS = "/path/1" "/path/2" 此外，下次您不知道一些xcconfig文件的语法时，只需转到构建设置窗格并使用复制命令（Cmd-C）并将其粘贴到您的文件中。 Try this: HEADER_SEARCH_PATHS = "/path/1" "/path/2" Also, next time you don't know the syntax for a bit of xcconfig file, just go to build sett ...

  • matplotlib标记中的多种颜色填充(Multiple color fills in matplotlib markers)[2023-10-18]

    您可以按照此处显示的matplotlib示例执行此操作： matplotlib.org/examples/api/scatter_piecharts.html 下面我稍微改变了示例，使用ax.plot而不是ax.scatter 。 基本上这意味着你的所有标记必须具有相同的大小，而不是使用s kwarg进行scatter ，而是使用ms （或markersize ）kwarg作为plot 。 此外，您需要定义markerfacecolor而不是markerfacecolor 。 除了这些更改之外，其他所有内容 ...

  • 打印统一的数字倍数的数字(Print numbers that are multiples of certain number uniformly)[2022-09-01]

    这是一个简单的解决方案，可以找到最接近给定系列倍数的步骤： def stepper(timestep, limit=100.0, multiple=10.0): current = multiples = 0.0 while current <= limit: step = current + timestep if step >= multiples: if multiples - current > step - multiples ...

  • 多个剪辑路径(Multiple clip-paths)[2022-04-18]

    这里的问题是关于堆叠上下文和绘制顺序 。 如果你将clip-path添加到你的下一个元素，那么它将位于第一个元素的顶部，因为它将创建一个新的堆叠上下文并将在稍后绘制，因为我们有负边距它将隐藏第一个的剪切部分。 除非之外的计算值导致堆叠上下文的创建方式与CSS不透明度对除了其他值之外的值相同 一个简单的解决方案是添加z-index来纠正所有这些： body { margin: 0; font-size: 10px; } body>div { clip-path: polygon(0 ...

  • 使用dockpanel平等地拉伸所有孩子(Use dockpanel to stretch all children equally)[2022-07-03]

    我不知道你知道如何使用哪个网格，但我发现最简单的解决方案是使用一行UniformGrid。 这应该平等地填充所有按钮。 I don't know which grid you know how to use, but I found the easiest solution is to use a UniformGrid with 1 row. That should fill all the buttons equally.

相关文章

更多
  • 移动MM failed to find resource file{mmiap.xml}
  • 【第四章】 资源 之 4.2 内置Resource实现 ——跟我学spring3
  • 【第四章】 资源 之 4.3 访问Resource ——跟我学spring3
  • 【第四章】 资源 之 4.4 Resource通配符路径 ——跟我学spring3
  • JDBC系列教程之一：jdbc简单介绍
  • JDBC 连接管理
  • com.mysql.jdbc.exceptions.MySQLIntegrityConstraintViolationException:
  • JDBC系列教程之二：jdbc连接数据的步骤
  • 传智播客JDBC视频教程
  • JDBC系列教程之十三：ResultSetMetaData

    • 最新问答

    更多
  • 获取MVC 4使用的DisplayMode后缀(Get the DisplayMode Suffix being used by MVC 4)
  • 如何通过引用返回对象？(How is returning an object by reference possible?)
  • 矩阵如何存储在内存中？(How are matrices stored in memory?)
  • 每个请求的Java新会话？(Java New Session For Each Request?)
  • css：浮动div中重叠的标题h1(css: overlapping headlines h1 in floated divs)
  • 无论图像如何，Caffe预测同一类(Caffe predicts same class regardless of image)
  • xcode语法颜色编码解释？(xcode syntax color coding explained?)
  • 在Access 2010 Runtime中使用Office 2000校对工具(Use Office 2000 proofing tools in Access 2010 Runtime)
  • 从单独的Web主机将图像传输到服务器上(Getting images onto server from separate web host)
  • 从旧版本复制文件并保留它们（旧/新版本）(Copy a file from old revision and keep both of them (old / new revision))
  • 西安哪有PLC可控制编程的培训
  • 在Entity Framework中选择基类(Select base class in Entity Framework)
  • 在Android中出现错误“数据集和渲染器应该不为null，并且应该具有相同数量的系列”(Error “Dataset and renderer should be not null and should have the same number of series” in Android)
  • 电脑二级VF有什么用
  • Datamapper Ruby如何添加Hook方法(Datamapper Ruby How to add Hook Method)
  • 金华英语角.
  • 手机软件如何制作
  • 用于Android webview中图像保存的上下文菜单(Context Menu for Image Saving in an Android webview)
  • 注意：未定义的偏移量：PHP(Notice: Undefined offset: PHP)
  • 如何读R中的大数据集[复制](How to read large dataset in R [duplicate])
  • Unity 5 Heighmap与地形宽度/地形长度的分辨率关系？(Unity 5 Heighmap Resolution relationship to terrain width / terrain length?)
  • 如何通知PipedOutputStream线程写入最后一个字节的PipedInputStream线程？(How to notify PipedInputStream thread that PipedOutputStream thread has written last byte?)
  • python的访问器方法有哪些
  • DeviceNetworkInformation：哪个是哪个？(DeviceNetworkInformation: Which is which?)
  • 在Ruby中对组合进行排序(Sorting a combination in Ruby)
  • 网站开发的流程？
  • 使用Zend Framework 2中的JOIN sql检索数据(Retrieve data using JOIN sql in Zend Framework 2)
  • 条带格式类型格式模式编号无法正常工作(Stripes format type format pattern number not working properly)
  • 透明度错误IE11(Transparency bug IE11)
  • linux的基本操作命令。。。

    • Copyright ©2023 peixunduo.com All Rights Reserved.粤ICP备14003112号

    本站部分内容来源于互联网，仅供学习和参考使用，请莫用于商业用途。如有侵犯你的版权，请联系我们(neng862121861#163.com)，本站将尽快处理。谢谢合作！