问为什么Fortify将其标记为未发布的资源？

EN

class Foo {
    final ReadWriteLock lock = new ReentrantReadWriteLock();

    Object read() {
        lock.readLock().lock();
        Object result;
        try {
            result = getResource();
        } finally {
            lock.readLock().unlock();
        }
        return result;
    }
}