JCL-456: Close streams (#156)

* JCL-456: Close streams

* Buffer stream in order to close resources before iterating

* Add iterator buffering implementation note (#157)

---------

Co-authored-by: Samu Lang <langsamu@users.noreply.github.com>

Author: acoburn

commons/src/main/java/com/inrupt/rdf/wrapping/commons/ObjectSet.java

@@ -112,8 +112,10 @@ public ObjectSet(
 
     @Override
     public int size() {
-        final long size = statements().count();
-        return size > Integer.MAX_VALUE ? Integer.MAX_VALUE : (int) size;
+        try (final Stream<? extends Triple> stream = statements()) {
+            final long size = stream.count();
+            return size > Integer.MAX_VALUE ? Integer.MAX_VALUE : (int) size;
+        }
     }
 
     @Override
@@ -131,14 +133,24 @@ public boolean contains(final Object o) {
         return graph.contains(subject, predicate, object);
     }
 
+    /**
+     * @implNote Prior to returning the iterator, this implementation consumes (buffers) an underlying
+     * {@link Graph#stream(BlankNodeOrIRI, IRI, RDFTerm) stream of statements} with the current {@link #subject} and
+     * {@link #predicate} as well as the {@link #valueMapping value mapping function} applied to each object.
+     */
     @Override
     public Iterator<T> iterator() {
-        return values().iterator();
+        try (final Stream<T> stream = values()) {
+            return stream.collect(Collectors.collectingAndThen(Collectors.toList(), Collections::unmodifiableList))
+                .iterator();
+        }
     }
 
     @Override
     public Object[] toArray() {
-        return values().toArray();
+        try (final Stream<T> stream = values()) {
+            return stream.toArray();
+        }
     }
 
     @Override
@@ -197,9 +209,11 @@ public boolean addAll(final Collection<? extends T> c) {
     public boolean retainAll(final Collection<?> c) {
         Objects.requireNonNull(c);
 
-        return values().collect(Collectors.toList()).stream()
+        try (final Stream<T> stream = values()) {
+            return stream.collect(Collectors.toList()).stream()
                 .map(value -> removeUnlessContains(c, value))
                 .reduce(false, EITHER);
+        }
     }
 
     // AbstractSet#removeAll relies on Iterator#remove, which is not supported here.

commons/src/main/java/com/inrupt/rdf/wrapping/commons/WrapperBlankNodeOrIRI.java

@@ -27,6 +27,7 @@
 import java.util.Iterator;
 import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import org.apache.commons.rdf.api.*;
@@ -103,7 +104,9 @@ protected <T> T anyOrNull(final IRI p, final ValueMapping<T> m) {
         Objects.requireNonNull(p);
         Objects.requireNonNull(m);
 
-        return objectStream(p, m).findAny().orElse(null);
+        try (final Stream<T> stream = objectStream(p, m)) {
+            return stream.findAny().orElse(null);
+        }
     }
 
     /**
@@ -183,12 +186,19 @@ protected <T> T singleOrThrow(final IRI p, final ValueMapping<T> m) {
      * @param <T> the type of values returned
      *
      * @return the converted objects of statements with this subject and the given predicate
+     *
+     * @implNote Prior to returning the iterator, this implementation consumes (buffers) an underlying
+     * {@link Graph#stream(BlankNodeOrIRI, IRI, RDFTerm) stream of statements} with the predicate {@code p} and the
+     * mapping function {@code m} applied to each object.
      */
     protected <T> Iterator<T> objectIterator(final IRI p, final ValueMapping<T> m) {
         Objects.requireNonNull(p);
         Objects.requireNonNull(m);
 
-        return objectStream(p, m).iterator();
+        try (final Stream<T> stream = objectStream(p, m)) {
+            return stream.collect(Collectors.collectingAndThen(Collectors.toList(), Collections::unmodifiableList))
+                .iterator();
+        }
     }
 
     /**
@@ -204,7 +214,9 @@ protected <T> Set<T> objectsReadOnly(final IRI p, final ValueMapping<T> m) {
         Objects.requireNonNull(p);
         Objects.requireNonNull(m);
 
-        return objectStream(p, m).collect(collectingAndThen(toSet(), Collections::unmodifiableSet));
+        try (final Stream<T> stream = objectStream(p, m)) {
+            return stream.collect(collectingAndThen(toSet(), Collections::unmodifiableSet));
+        }
     }
 
     /**

jena/pom.xml

@@ -39,6 +39,11 @@
       <artifactId>hamcrest</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
   <build>

pom.xml

@@ -127,6 +127,12 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <!-- patch CVE-2024-25710 commons-compress 1.26.0 -->
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-compress</artifactId>
+        <version>1.26.0</version>
+      </dependency>
 
       <!-- testing -->
       <dependency>
@@ -535,7 +541,6 @@
           </execution>
         </executions>
         <configuration>
-          <cveValidForHours>24</cveValidForHours>
           <failBuildOnCVSS>7</failBuildOnCVSS>
           <formats>
             <format>HTML</format>

rdf4j/pom.xml

@@ -43,6 +43,11 @@
       <version>${project.version}</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
   <build>

test/commons/pom.xml

@@ -35,6 +35,10 @@
       <groupId>org.mockito</groupId>
       <artifactId>mockito-core</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+    </dependency>
   </dependencies>
 
   <build>

test/jena/pom.xml

@@ -34,6 +34,11 @@
       <artifactId>jena-commonsrdf</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
   <build>

test/rdf4j/pom.xml

@@ -46,6 +46,11 @@
       <artifactId>rdf4j-repository-sail</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
   <build>