rspec/rules/S2792/java/rule.adoc
2021-04-28 18:08:03 +02:00

39 lines
1.1 KiB
Plaintext

According to the JDBC specification:
____
``++Blob++``, ``++Clob++``, and ``++NClob++`` Java objects remain valid for at least the duration of the transaction in which they are created. This could potentially result in an application running out of resources during a long running transaction.
____
== Noncompliant Code Example
----
PreparedStatement ps = conn.prepareStatement("SELECT text, img from photos where author=?");
ps.setString(1,author);
ResultSet rs = ps.executeQuery();
while (rs.next()) {
Image image = saveImg(rs.getBlob("img").getBinaryStream()); // Noncompliant; blob is never freed
image.addCaption(rs.getClob("text").getCharacterStream()); // Noncompliant
}
----
== Compliant Solution
----
PreparedStatement ps = conn.prepareStatement("SELECT text, img from photos where author=?");
ps.setString(1,author);
ResultSet rs = ps.executeQuery();
while (rs.next()) {
Blob blob = rs.getBlob("img");
Image image = saveImg(blob.getBinaryStream());
blob.free();
Clob clob = rs.getClob("text");
image.addCaption(clob.getCharacterStream());
clob.free();
}
----