Fix resource leaks

[al-niessner]

🗒️ Summary

Syntax sugar to make false positives go away.

⚙️ Test Data and/or Report

Code scanning does not list these anymore.

♻️ Related Issues

Closes #118

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[al-niessner]

@jordanpadams @nutjob4life

Your CI needs some love and attention. First, it marked an old issue that is on main from 3 weeks ago a new problem on this branch that was found 3 weeks ago.

Second, if we just leave the results float with the crap in them that are false positives like the log injection that failed 3 weeks ago, then we crowd out good information with floating junk. Can we mark them as false positives and get them out of the scanning results?

Third, something failed in the code scanning but the branch can still be merged with a review and the quality gate has passed with a failure. What is the point of code scanning if it just sends crap code into production?

[nutjob4life]

@al-niessner could you toss in some handy links to the old and new issues that's getting the undue attention?

[al-niessner]

@nutjob4life

Sure. First thing I noticed was that the code scan resulted in a red X in checks area of this PR. So I clicked on it. It says near the top of the page in big bold letters: "New alerts in code changed by this pull request". In finer print, the file service/ProductService.java:107. Now you can follow that link, view the file, then do a blame to see line 107 is 3 years old. Or, you can follow the links in the problem setup (what I did) for the resource leak, select "code scanning" top left of page, then notice 85 is the log injection. That page says it found it 5 days ago too and file is service/ProductService.java:107. I guess I should have said 3 years ago not 3 weeks ago from the blame. Code scanning was telling me 5 days. Must have mixed them up in my head.

[jordanpadams]

@al-niessner I just removed removed the legacy branch protections and instead created a new branch ruleset that should no longer cause this confusion.