[LucaBonamino]

This PR addresses the JDBC resource leaks reported in #931.

Several SQL Injection challenges do not properly release database connections, statements, and result sets. As a result, repeated requests can exhaust the HikariCP connection pools, causing subsequent queries to fail until Tomcat is restarted.

Changes

• Use Java's try-with-resources to ensure JDBC resources are properly closed.
• Ensure database connections are returned to the HikariCP pools, even when
  SQL queries fail or exceptions occur.
• Preserve the existing SQL queries and the intentionally vulnerable behavior
  of the challenges.

The changes address resource management without altering the educational
purpose of the SQL Injection exercises.

Testing

After applying the fix and rebuilding the application, repeated valid and malformed SQL queries no longer exhausted the affected connection pools during local testing.

Related issue

Fixes #931

[Copilot]

🟢 Approval recommended

The resource scopes cover normal and exceptional execution without changing challenge behavior, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

This PR addresses #931 by fixing JDBC resource leaks in SQL injection challenges, preventing connection-pool exhaustion while preserving their intentionally vulnerable behavior.

Changes:

• Use try-with-resources to release connections and statements on successful and exceptional paths.
• Explicitly manage result sets in challenges 1, 3, and 4; challenge 5’s result set closes with its prepared statement.
• Preserve existing SQL queries and result handling.

File	Description
src/​main/​java/​servlets/​module/​challenge/​SqlInjection5.java	Automatically close the coupon-query connection and prepared statement.
src/​main/​java/​servlets/​module/​challenge/​SqlInjection4.java	Automatically close JDBC resources for the login query.
src/​main/​java/​servlets/​module/​challenge/​SqlInjection3.java	Automatically close JDBC resources for the customer-name search.
src/​main/​java/​servlets/​module/​challenge/​SqlInjection1.java	Automatically close JDBC resources for the customer-ID search.

_{Review effort: Balanced}

[ismisepaul]

Thanks @LucaBonamino for the fix and the clear write-up.

Before merging, a couple of things:

• Add regression tests: For changes like this we should add integration tests, if you could make leak tests for SQL Injection 1, 3, 4 and 5 within SqlInjectionPoolLeakIT.java. e.g. I've created the file here I can deal with the conflict so don't worry about that https://github.com/OWASP/SecurityShepherd/pull/998/changes#diff-f9d4f9475aa33e4019ec49bda3183c6d9cbbd0ef32f19a327b07a1b8bffd7ca2
• Manually Verify the challenges: Solve all four using their cheat sheet solutions and confirm in a PR comment that they still return the expected result keys.
• Small cleanup: Remove the stray ; in SqlInjection4.java:103.

Once those are done, I'm happy to approve. Thanks!