False Negative : CloseSql.ql cannot detect bugs in the Try-Catch block.

[Carlson-JLQ]

Version
codeql 2.23.9
Description of the issue
When I used java/Likely Bugs/Resource Leaks/CloseSql.ql to check the following code, it correctly reported an issue of improper use of createStatement.

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
public class PosCase3 {
    public void test() throws SQLException {
        // Scenario 3: Primary resource assigned
        Connection conn = DriverManager.getConnection("url", "user", "pass");
        // Secondary created from primary, not assigned, not closed
        conn.createStatement(); // [REPORTED LINE]
        // Secondary Statement leak -> Positive detection.
    }
}

However, when using CloseSql.ql to detect the following code, no bug were detected and no bug were reported.

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.function.Supplier;
public class PosCase3_Var3 {
    public void test() throws SQLException {
        // Variant 3: Use Supplier to defer creation, then discard
        Connection conn = DriverManager.getConnection("url", "user", "pass");
        Supplier<Statement> supplier = () -> {
            try {
                return conn.createStatement();
            } catch (SQLException e) {
                throw new RuntimeException(e);
            }
        };
        supplier.get();  // Statement created and leaked
    }
}

[oscarsj]

Thanks for your false negative report. I will escalate it to the relevant team for them to triage.

[hvitved]

The query is conservative, and will not flag resources that may escape the function in which it is constructed (because then it may be closed elsewhere). In the latter example, conn.createStatement() is returned from the closure in which it is constructed, which is why it is not flagged. That being said, it might make sense to make the query less conservative, but that is currently not a priority, I'm afraid.