SonarQube: Close this "PreparedStatement" in a "finally" clause (dealing with false positives)

Question

Every now and then we come across with some Sonarqube reported issues that seem (at least to us) as false positives.

For example when using a Spring JdbcTemplate to execute an update:

@Autowired
private JdbcTemplate jdbc;

PS: Sonar interface is in Spanish

Questions:

1. Is this actually a false positive? I guess it is as the PreparedStamente is never else referenced, but used (and hopefully closed) internally by the JdbcTemplate.
2. If it is, how should it be handled in SonarQube?
3. Could the corresponding plugin (SonarJava I guess) be improved to detect these patterns?
4. Any suggestions on improving our coding in this scenario to avoid SonarQube detecting it as an issue?

Answer 1

1. It is a false positive since as you say we trust that it is closed internally by the JdbcTemplate. SonarQube has the assumption that the block of code that constructs a PreparedStament is responsible for closing it.
2. You can use the SonarQube UI to flag this particular issue as a false positive. If you always rely on JdbcTemplate closing your PreparedStament throughout your entire codebase, then you could look into disabling the check globally by configuring your Quality Profile.
3. It might be possible if e.g. the plugin assumes that a PreparedStament constructed inside a PreparedStamentCreator does not need to be closed manually. You could discuss it on the SonarQube group.
4. In this particular scenario I think what you are doing is fine and it is just a false positive.