Tweaked transformation to not close if the execute is the first usage

Author: andrecsilva

framework/codemodder-base/src/main/java/io/codemodder/remediation/sqlinjection/SQLParameterizer.java

@@ -708,10 +708,17 @@ private MethodCallExpr fixByHijackedStatement(
     ASTTransforms.addStatementBeforeStatement(topStatement, pStmtCreation);
     topStatement = pStmtCreation;
 
-    // add stmt.close()
-    Statement closeOriginal =
-        new ExpressionStmt(new MethodCallExpr(new NameExpr(stmtName), new SimpleName("close")));
-    ASTTransforms.addStatementBeforeStatement(topStatement, closeOriginal);
+    // Test if stmt.execute*() is the first usage of the stmt object
+    // If so, remove initializer
+    // otherwise add stmt.close()
+    if (isExecuteFirstUsageAfterDeclaration(stmtCreation, executeCall)) {
+      var lvd = stmtCreation.getRight();
+      lvd.getVariableDeclarator().getInitializer().ifPresent(i -> i.remove());
+    } else {
+      Statement closeOriginal =
+          new ExpressionStmt(new MethodCallExpr(new NameExpr(stmtName), new SimpleName("close")));
+      ASTTransforms.addStatementBeforeStatement(topStatement, closeOriginal);
+    }
 
     // TODO will this work for every type of execute statement? or just executeQuery?
     // change execute statement
@@ -729,6 +736,23 @@ private MethodCallExpr fixByHijackedStatement(
     return prepareStatementCall;
   }
 
+  private boolean isExecuteFirstUsageAfterDeclaration(
+      final Either<AssignExpr, LocalVariableDeclaration> stmtCreation,
+      final MethodCallExpr executeCall) {
+    if (stmtCreation.isRight()) {
+      var lvd = stmtCreation.getRight();
+      // This is heuristics
+      return ASTs.findAllReferences(lvd).stream()
+          .findFirst()
+          .flatMap(e -> ASTs.isScopeInMethodCall(e))
+          .filter(mce -> mce == executeCall)
+          .isPresent();
+    }
+    // We could also apply this predicate to assignments and remove it, but that may require more
+    // checks
+    return false;
+  }
+
   /**
    * Checks if {@code methodCall} is a query call that needs to be fixed and fixes if that's the
    * case. If the parameterization happened, returns the PreparedStatement creation.