False Negative: CloseWriter.ql misses leaked wrapped streams when the close is skipped by an early return or hidden in a factory.

Bắt đầu bằng cách đọc Likely Bugs/Resource Leaks/CloseWriter.ql và kiểm tra các case bị ảnh hưởng trong PosCase2_Var3.java và PosCase2_Var5.java. Theo dõi cách query xử lý các lệnh return sớm và các stream được tạo bởi helper, sau đó chạy các test CloseWriter liên quan. Hoàn thành khi cả hai case đều được báo cáo là leak mà không làm hỏng coverage hiện có.

Version
codeql 2.24.3

Checker

• Checker id: Likely Bugs/Resource Leaks/CloseWriter.ql
• Checker description: This checker detects instances where a Writer or OutputStream is created but not guaranteed to be closed on method exit, potentially causing resource leaks.

Description of the false negative

Both examples still leak the underlying file stream. One exits the method before the wrapper is closed. The other moves stream construction into a helper and then never closes the returned wrapper.

Those are ordinary resource-leak scenarios. Neither refactoring changes the ownership or lifetime of the stream.

Affected test cases

PosCase2_Var3.java

The return bypasses the only close() call. bos and the wrapped FileOutputStream both remain unclosed on the live path.

// FileOutputStream passed to BufferedOutputStream where inner resource not guaranteed to be closed should be flagged.
package scensct.var.pos;

import java.io.BufferedOutputStream;
import java.io.FileOutputStream;
import java.io.IOException;

public class PosCase2_Var3 {
    public void writeBuffered() throws IOException {
        // Variant 3: Introduce early return that skips close
        FileOutputStream fos = new FileOutputStream("data.bin");
        BufferedOutputStream bos = new BufferedOutputStream(fos);
        bos.write(1);
        if (System.currentTimeMillis() > 0) {
            return; // exit without closing
        }
        // Unreachable code, close never called
        bos.close();
    }
}

PosCase2_Var5.java

The factory method only hides allocation. It does not transfer cleanup responsibility anywhere else, and the caller still never closes the returned stream.

// FileOutputStream passed to BufferedOutputStream where inner resource not guaranteed to be closed should be flagged.
package scensct.var.pos;

import java.io.BufferedOutputStream;
import java.io.FileOutputStream;
import java.io.IOException;

public class PosCase2_Var5 {
    public void writeBuffered() throws IOException {
        // Variant 5: Wrap in a method that returns the BufferedOutputStream without closing
        BufferedOutputStream bos = openBufferedStream("data.bin");
        bos.write(1);
        // Not closed
    }
    
    private BufferedOutputStream openBufferedStream(String file) throws IOException {
        FileOutputStream fos = new FileOutputStream(file);
        return new BufferedOutputStream(fos);
    }
}

Cause analysis

Likely Bugs/Resource Leaks/CloseWriter.ql looks too dependent on one direct construction-and-close pattern. As soon as the leak is expressed through an early return or a helper that returns the wrapper, the result disappears.

That is too brittle for a resource-leak query. In real code, stream creation is often factored into small helpers, and missing close calls frequently happen on short-circuit exits.