github / github/codeql

False Negative: CloseWriter.ql misses leaked wrapped streams when the close is skipped by an early return or hidden in a factory.

Open
#21,534 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

Version
codeql 2.24.3

## Checker
- Checker id: `Likely Bugs/Resource Leaks/CloseWriter.ql`
- Checker description: This checker detects instances where a Writer or OutputStream is created but not guaranteed to be closed on method exit, potentially causing resource leaks.

## Description of the false negative
Both examples still leak the underlying file stream. One exits the method before the wrapper is closed. The other moves stream construction into a helper and then never closes the returned wrapper.

Those are ordinary resource-leak scenarios. Neither refactoring changes the ownership or lifetime of the stream.

## Affected test cases
### `PosCase2_Var3.java`
The `return` bypasses the only `close()` call. `bos` and the wrapped `FileOutputStream` both remain unclosed on the live path.

```java
// FileOutputStream passed to BufferedOutputStream where inner resource not guaranteed to be closed should be flagged.
package scensct.var.pos;

import java.io.BufferedOutputStream;
import java.io.FileOutputStream;
import java.io.IOException;

public class PosCase2_Var3 {
public void writeBuffered() throws IOException {
// Variant 3: Introduce early return that skips close
FileOutputStream fos = new FileOutputStream("data.bin");
BufferedOutputStream bos = new BufferedOutputStream(fos);
bos.write(1);
if (System.currentTimeMillis() > 0) {
return; // exit without closing
}
// Unreachable code, close never called
bos.close();
}
}
```

### `PosCase2_Var5.java`
The factory method only hides allocation. It does not transfer cleanup responsibility anywhere else, and the caller still never closes the returned stream.

```java
// FileOutputStream passed to BufferedOutputStream where inner resource not guaranteed to be closed should be flagged.
package scensct.var.pos;

import java.io.BufferedOutputStream;
import java.io.FileOutputStream;
import java.io.IOException;

public class PosCase2_Var5 {
public void writeBuffered() throws IOException {
// Variant 5: Wrap in a method that returns the BufferedOutputStream without closing
BufferedOutputStream bos = openBufferedStream("data.bin");
bos.write(1);
// Not closed
}

private BufferedOutputStream openBufferedStream(String file) throws IOException {
FileOutputStream fos = new FileOutputStream(file);
return new BufferedOutputStream(fos);
}
}
```

## Cause analysis
`Likely Bugs/Resource Leaks/CloseWriter.ql` looks too dependent on one direct construction-and-close pattern. As soon as the leak is expressed through an early return or a helper that returns the wrapper, the result disappears.

That is too brittle for a resource-leak query. In real code, stream creation is often factored into small helpers, and missing close calls frequently happen on short-circuit exits.

Contributor guide

Open the contributing guide

Research direction

Start by reading Likely Bugs/Resource Leaks/CloseWriter.ql and inspect the affected PosCase2_Var3.java and PosCase2_Var5.java cases. Trace how the query handles early returns and helper-created streams, then run the relevant CloseWriter tests. Done means both cases are reported as leaks without breaking existing coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.