github-advanced-security[bot] commented on code in PR #19816:
URL: https://github.com/apache/druid/pull/19816#discussion_r3684397468
##########
extensions-contrib/moving-average-query/src/test/java/org/apache/druid/query/movingaverage/MovingAverageQueryTest.java:
##########
@@ -171,9 +176,10 @@
retryConfig = injector.getInstance(RetryQueryRunnerConfig.class);
serverConfig = injector.getInstance(ServerConfig.class);
- InputStream is = getClass().getResourceAsStream("/queryTests/" + yamlFile);
ObjectMapper reader = new ObjectMapper(new YAMLFactory());
- config = reader.readValue(is, TestConfig.class);
+ try (final InputStream is = getClass().getResourceAsStream("/queryTests/"
+ yamlFile)) {
Review Comment:
## CodeQL / Unsafe use of getResource
The idiom getClass().getResource() is unsafe for classes that may be
extended.
[Show more
details](https://github.com/apache/druid/security/code-scanning/11423)
##########
sql/src/test/java/org/apache/druid/sql/avatica/DruidAvaticaHandlerTest.java:
##########
@@ -1090,11 +1101,15 @@
for (int i = 0; i < CONNECTION_LIMIT * 2; i++) {
try (Connection connection = server.getUserConnection()) {
// Note: NOT in a try-catch block. Let the connection close the
statement
+ // codeql[java/database-resource-leak]
final Statement statement = connection.createStatement();
// Again, NOT in a try-catch block: let the statement close the
// result set.
- final ResultSet resultSet = statement.executeQuery("SELECT COUNT(*) AS
cnt FROM druid.foo");
+ // codeql[java/database-resource-leak]
+ final ResultSet resultSet = statement.executeQuery(
+ "SELECT COUNT(*) AS cnt FROM druid.foo"
+ );
Review Comment:
## CodeQL / Potential database resource leak
This ResultSet is not always closed on method exit.
[Show more
details](https://github.com/apache/druid/security/code-scanning/11424)
##########
processing/src/main/java/org/apache/druid/java/util/common/io/smoosh/FileSmoosher.java:
##########
@@ -447,7 +447,9 @@
this.outFile = outFile;
this.maxLength = maxLength;
- FileOutputStream outStream = closer.register(new
FileOutputStream(outFile)); // lgtm [java/output-resource-leak]
+ // The closer owns this stream for the lifetime of the writer and
releases it in close().
+ // codeql[java/output-resource-leak]
+ final FileOutputStream outStream = closer.register(new
FileOutputStream(outFile));
Review Comment:
## CodeQL / Potential output resource leak
This FileOutputStream is not always closed on method exit.
[Show more
details](https://github.com/apache/druid/security/code-scanning/11425)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
