Fortofy扫描安全漏洞解决——Unreleased Resource: Streams未释放资源漏洞

本文主要是介绍Fortofy扫描安全漏洞解决——Unreleased Resource: Streams未释放资源漏洞，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

问题描述：
大部分 Unreleased Resource 问题只会导致一般的软件可靠性问题，但如果攻击者能够故意触发资源泄漏，该攻击者就有可能通过耗尽资源池的方式发起 denial of service 攻击。

问题代码：

 FileInputStream inputStream = new FileInputStream(sourcePath);FileOutputStream outputStream = new FileOutputStream(destinationPath);byte[] buffer = new byte[1024];int bytesRead;while ((bytesRead = inputStream.read(buffer)) != -1) {outputStream.write(buffer, 0, bytesRead);}// 注意：这里缺少关闭资源的代码

解决方案1：使用try-catch-finally，在finally语句块中关闭资源(一般还是会被Fortofy扫描出来)

        FileInputStream inputStream = null;FileOutputStream outputStream = null;try {inputStream = new FileInputStream(sourcePath);outputStream = new FileOutputStream(destinationPath);byte[] buffer = new byte[1024];int bytesRead;while ((bytesRead = inputStream.read(buffer)) != -1) {outputStream.write(buffer, 0, bytesRead);}} catch (IOException e) {e.printStackTrace();} finally {try {if (inputStream != null) {inputStream.close();}if (outputStream != null) {outputStream.close();}} catch (IOException e) {e.printStackTrace();}}

解决方案2：使用try-with-resources方式解决(不会被Fortofy检测出漏洞)

        try-with-resources大家不太常见，格式就是在try与catch语句块之间加入小括号，我们在小括号之中编写开启文件流代码，try-with-resources会为我们管理文件流，大伙儿无需手动关闭流资源。强烈推荐使用！增加代码可读性和行数，也会避免犯错。
 

    try (FileInputStream inputStream = new FileInputStream(sourcePath);FileOutputStream outputStream = new FileOutputStream(destinationPath)) {byte[] buffer = new byte[1024];int bytesRead;while ((bytesRead = inputStream.read(buffer)) != -1) {outputStream.write(buffer, 0, bytesRead);}} // try-with-resources 会自动关闭资源}

​​​​​​​

这篇关于Fortofy扫描安全漏洞解决——Unreleased Resource: Streams未释放资源漏洞的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！

---