To add to the legit concern of the original poster here’s another similar situation where this rule produces false-positives:
jdbcTemplate.update(new PreparedStatementCreator() {
@Override
public PreparedStatement createPreparedStatement(Connection con) throws SQLException {
PreparedStatement ps = con.prepareStatement(MessageConstant.INSERT_CUSTOM_RNSD_SCREEN_QUERY,
new String[] { "SCREEN_ID" });
ps.setString(1, request.getScreenName());
ps.setString(2, request.getScreenType());
ps.setString(3, request.getForeignUserGroup());
ps.setTimestamp(4, new Timestamp(System.currentTimeMillis()));
ps.setString(5, request.getCreatedBy());
return ps;
}
}, keyHolder);
The “jdbcTemplate” above is a Spring JdbcTemplate. I’ve verified that JdbcTemplate’s “update” method does close the prepared statement in a finally block.
Also note that this other similar bug report exists for java:S2095.