title: Sonar way with Findbugs not detecting database connection close
body: <p>We have setup SonarQube (version 4.3.2) with Ruleset from Findbugs and PMD.</p>
  
  <p>Details of the issue faced is as follows:
  There is an application which has a class which creates a Connection object (java.sql.Connection) and just passes plainly passes the connection object to ArrayDescriptor.createDescriptor method.
  The ArrayDescriptor class is an internal Oracle class (oracle.sql.ArrayDescriptor). Now the code doesnt do anything else with the connection object. 
  Code did not close the connection that was created to pass to the method which would lead to a leak connection (in my knowledge). In place where connection is closed (fortunately!) it is not done in finally block. Now ideally rules of Findbugs should have caught this.
  In my understandting the following active rules should have been violated :</p>
  
  <ol>
  <li>Bad practice - Method may fail to close database resource</li>
  <li>Bad practice - Method may fail to close database resource on exception</li>
  <li>Bad practice - Method may fail to close stream</li>
  <li>Bad practice - Method may fail to close stream on exception</li>
  </ol>
  
  <p>But none of these was reported for the code.</p>
  
  <p>We then installed PMD plugin to include the rule - Repository: pmd  Key: CloseResource<br>
  When this was enabled, closeResource was reported but only where connection object was a method level variable , i.e. something like:</p>
  
  <pre><code>public void nameOfMethod() throws SQLException {
      try {
  
          InitialContext context = new InitialContext();
          DataSource ds = (DataSource) context.lookup("DS");
          Connection connnew = ds.getConnection();
      }
  </code></pre>
  
  <p>However if Connection object is a class level variable even this rule does not detect the issue. (I understand that keeping Connection as class level variable is not a good practise, and we are trying to educate on not using it, but for people who do it, the closure of connection should ideally be detected)</p>
  
  <p>Hence my question is:
  1. My expectation is all the above rules should be detected in places where a. Conenction object is created  and not closed OR Connection object created and passed to an internal method (ArrayDescriptor.createDescriptor ) c) conenction created, closed but not closed in finally block.
  Is this expectation wrong?
  2. If expectation is right, why isnt Sonar with Findbugs detecting it?
  3. Why is PMD detecting this only for method level variables or is there some other issue.</p>
  
  <p>Appreciate your help on this.</p>
  
  <p>SonarQube Version- 4.3.2</p>
  
  <p>Info:
  Plugin versions
  Checkmarx - 7.1.2-3.0.1
  Findbugs - 2.1
  JaCoCo - 2.1
  Java - 2.1
  Squid for Java - 2.1
  Surefire - 2.1
  Web - 2.1</p>