关于finally和return

try {
            conn = sp.getConnection();
            ps = conn.prepareStatement(sql, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);
            for (int i = 0; i < sqlValueList.size(); i++) {
                ps.setString(i + 1, sqlValueList.get(i));
            }
            rs = ps.executeQuery();
            rsMetaData = rs.getMetaData();
            int count = rsMetaData.getColumnCount();
            while (rs.next()) {
                Map<String, String> rsMap = new HashMap();
                for (int i = 1; i <= count; i++) {
                    String ColumnName = rsMetaData.getColumnName(i);
                    String ColumnValue = rs.getString(ColumnName);
                    rsMap.put(ColumnName, ColumnValue);
                }
                RsList.add(rsMap);
            }
        } catch (GenericDataSourceException e) {
            Debug.logError(e, module);
            SessionContext.setSystemException();
            throw new BusinessException(ErrorCode.TCH00061);
        } catch (GenericEntityException e) {
            Debug.logError(e, module);
            SessionContext.setSystemException();
            throw new BusinessException(ErrorCode.TCH00061);
        } catch (SQLException e) {
            Debug.logError(e, module);
            SessionContext.setSystemException();
            throw new BusinessException(ErrorCode.TCH00061);
        } catch (NullPointerException e) {
            Debug.logError(e, module);
            SessionContext.setSystemException();
            throw new BusinessException(ErrorCode.TCH00061);
        }

        finally {
        	SqlHelp.freeResource(sp, rs, conn, ps);
                return RsList;



        }

    最近在开发中看到这样一段代码，见上，通过fortify扫描报出安全警告，通过查找fortify官网给出以下解释（转自fortify官网）

Return Inside Finally Block

From OWASP

Jump to: navigation , search

<!-- start content -->

This is a Vulnerability . To view all vulnerabilities, please see the Vulnerability Category page.

 

This article includes content generously donated to OWASP by .

Last revision (mm/dd/yy): 2/28/2009

Vulnerabilities Table of Contents

 

Description

Returning from inside a finally block will cause exceptions to be lost.

A return statement inside a finally block will cause any exception that might be thrown in the try block to be discarded.

 

Risk Factors

TBD

Examples

In the following code excerpt, the IllegalArgumentException will never be delivered to the caller. The finally block will cause the exception to be discarded.

 

try {
	  ...
	  throw IllegalArgumentException();
	}
	finally {
	  return r;
	}

    通俗点说就是会覆盖返回值，如果try中返回1，finally中返回2，最后的返回值是2，因为finally执行是在try之后，返回值返回之前，保证在返回之前把必须要做的事情完成，例如关闭流啊等等。

    但本人认为还是需要具体问题，具体分析，如果就是需要覆盖返回值用也没太大问题。但是如果没有这个需求或者根本不需要返回，千万不要再finally中return 这样会使返回值或异常不精确。