Java: Use finally keywords to avoid resource Vulnerabilities

 

Compared with other language models,The finally keyword is the best supplement to the Java Exception Handling Model. The finally structure enables code to always be executed, regardless of exceptions. Using finally, you can maintain the internal status of an object and clear non-memory resources. Without finally, your code will be hard to understand. For example, the following code describes how to write code to release non-memory resources without using finally:

Import java.net .*;
Import java. io .*;

Class WithoutFinally
{
Public void foo () throws IOException
{
// Create a socket on any idle Port
ServerSocket ss = new ServerSocket (0 );
Try {
Socket socket = ss. accept ();
// Other code here...
}
Catch (IOException e ){
Ss. close (); // 1
Throw e;
}

//...
Ss. close (); // 2
}
}
This Code creates a socket and calls the accept method. Before exiting this method, you must disable this socket to avoid resource vulnerabilities. To complete this task, we call close at // 2, which is the last statement of the method. However, what if an exception occurs in the try block? In this case, the close call at // 2 will never happen. Therefore, you must capture this exception and insert another call to close at // 1 before sending the exception again. In this way, you can disable the socket before exiting this method.

Writing code in this way is both troublesome and error-prone, but it is essential without finally. Unfortunately, in a language without a finally mechanism, programmers may forget to organize their code in this way, leading to resource vulnerabilities. The finally clause in Java solves this problem. With finally, the previous code can be rewritten as follows:

Import java.net .*;
Import java. io .*;

Class WithFinally
{
Public void foo2 () throws IOException
{
// Create a socket on any idle Port
ServerSocket ss = new ServerSocket (0 );
Try {
Socket socket = ss. accept ();
// Other code here...
}
Finally {
Ss. close ();
}
}
}
The finally block ensures that the close method is always executed, regardless of whether an exception occurs in the try block. Therefore, you can ensure that the close method is always called before exiting this method. In this way, you can be sure that the socket is closed and you have not leaked resources. In this method, no catch block is required. In the first example, the catch block is provided only to close the socket. Now it is closed through finally. If you provide a catch Block, the code in the finally block is executed after the catch Block is complete.

Finally blocks must be used with try or try/catch blocks. In addition, it is impossible to exit the try block without executing its finally block. If a finally block exists, it will always execute. (From that point of view, this statement is correct. One way is to exit the try block without executing the finally block. If the code executes a System. exit (0); statement within try, the application is terminated without finally execution. On the other hand, if you turn off the power during the try block execution, finally will not .)