github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-25 02:21:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated to correctly close the ObjectOutputStream based on guidance from the CERT Java Secure Coding Standard

Browse Source 
Former-commit-id: 1c7b929055f273d49b1203c117d7bb12162cfdb2
This commit is contained in:
Jeremy Long
2014-09-12 06:36:00 -04:00
parent d4756c9eb8
commit c503935d6a
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java
View File

@@ -25,7 +25,6 @@ import java.io.FileOutputStream;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.io.ObjectInputStream; import java.io.ObjectInputStream;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream; import java.io.ObjectOutputStream;
import java.io.OutputStream; import java.io.OutputStream;
import java.util.List; import java.util.List;
@@ -829,13 +828,18 @@ public class DependencyCheckMojo extends ReportAggregationMojo {
file = new File(getProject().getBuild().getDirectory(), getDataFileName()); file = new File(getProject().getBuild().getDirectory(), getDataFileName());
OutputStream os = null; OutputStream os = null;
OutputStream bos = null; OutputStream bos = null;
ObjectOutput out = null; ObjectOutputStream out = null;
try { try {
os = new FileOutputStream(file); os = new FileOutputStream(file);
bos = new BufferedOutputStream(os); bos = new BufferedOutputStream(os);
out = new ObjectOutputStream(bos); out = new ObjectOutputStream(bos);
out.writeObject(engine.getDependencies()); out.writeObject(engine.getDependencies());
out.flush(); out.flush();
//call reset to prevent resource leaks per
//https://www.securecoding.cert.org/confluence/display/java/SER10-J.+Avoid+memory+and+resource+leaks+during+serialization
out.reset();
} catch (IOException ex) { } catch (IOException ex) {
LOGGER.log(Level.WARNING, "Unable to create data file used for report aggregation; " LOGGER.log(Level.WARNING, "Unable to create data file used for report aggregation; "
+ "if report aggregation is being used the results may be incomplete."); + "if report aggregation is being used the results may be incomplete.");