#vulnerable code 
                                private String uploadGoodsPhoto(CommonsMultipartFile file) {
        final String s = "/Users/heng/java学习/";
        String path = s + file.getOriginalFilename();
        try {
            String filePath = s;
            File file_tmp = new File(filePath);
            if (!file_tmp.exists() && !file_tmp.mkdirs()) {
                throw new HengException("dir create error!");
            }
            FileOutputStream fos = new FileOutputStream(path);
            InputStream is = file.getInputStream();
            int b = 0;
            while ((b = is.read()) != -1) {
                fos.write(b);
            }
            fos.flush();
            fos.close();
            is.close();
        } catch (IOException e) {
            throw new HengException("上传文件异常");
        }
        return path;
    } 
                            #location 19 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                private String uploadGoodsPhoto(CommonsMultipartFile file) throws IOException {
        final String s = "/Users/heng/java学习/";
        String path = s + file.getOriginalFilename();
        FileOutputStream fos = null;
        InputStream is = null;
        try {
            String filePath = s;
            File file_tmp = new File(filePath);
            if (!file_tmp.exists() && !file_tmp.mkdirs()) {
                throw new HengException("dir create error!");
            }
            fos = new FileOutputStream(path);
            is = file.getInputStream();
            int b;
            while ((b = is.read()) != -1) {
                fos.write(b);
            }
            fos.flush();
        } catch (IOException e) {
            logger.error("error message is:", e);
            throw new HengException("上传文件异常");
        } finally {
            if (fos!=null){
                fos.close();
            }
            if (is!=null){
                is.close();
            }

        }
        return path;
    }