#fixed code
                                public void testCreateSocket() throws Exception {
        HttpParams params = new BasicHttpParams();
        String password = "changeit";
        char[] pwd = password.toCharArray();

        RSAPrivateCrtKeySpec k;
        k = new RSAPrivateCrtKeySpec(new BigInteger(RSA_PUBLIC_MODULUS, 16),
                                     new BigInteger(RSA_PUBLIC_EXPONENT, 10),
                                     new BigInteger(RSA_PRIVATE_EXPONENT, 16),
                                     new BigInteger(RSA_PRIME1, 16),
                                     new BigInteger(RSA_PRIME2, 16),
                                     new BigInteger(RSA_EXPONENT1, 16),
                                     new BigInteger(RSA_EXPONENT2, 16),
                                     new BigInteger(RSA_COEFFICIENT, 16));

        PrivateKey pk = KeyFactory.getInstance("RSA").generatePrivate(k);
        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(null, null);

        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        InputStream in1, in2, in3;
        in1 = new ByteArrayInputStream(X509_FOO);
        in2 = new ByteArrayInputStream(X509_INTERMEDIATE_CA);
        in3 = new ByteArrayInputStream(X509_ROOT_CA);
        X509Certificate[] chain = new X509Certificate[3];
        chain[0] = (X509Certificate) cf.generateCertificate(in1);
        chain[1] = (X509Certificate) cf.generateCertificate(in2);
        chain[2] = (X509Certificate) cf.generateCertificate(in3);

        ks.setKeyEntry("RSA_KEY", pk, pwd, chain);
        ks.setCertificateEntry("CERT", chain[2]); // Let's trust ourselves. :-)

        KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(KeyManagerFactory
                .getDefaultAlgorithm());
        kmfactory.init(ks, pwd);
        KeyManager[] keymanagers = kmfactory.getKeyManagers();
            
        TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm());
        tmfactory.init(ks);
        TrustManager[] trustmanagers = tmfactory.getTrustManagers();
        
        SSLContext sslcontext = SSLContext.getInstance("TLSv1");
        sslcontext.init(keymanagers, trustmanagers, null);
        
        LocalTestServer server = new LocalTestServer(null, null, null, sslcontext);
        server.registerDefaultHandlers();
        server.start();
        try {
            
            TestX509HostnameVerifier hostnameVerifier = new TestX509HostnameVerifier();
            
            SSLSocketFactory socketFactory = new SSLSocketFactory(sslcontext);
            socketFactory.setHostnameVerifier(hostnameVerifier);
            
            Scheme https = new Scheme("https", socketFactory, 443); 
            DefaultHttpClient httpclient = new DefaultHttpClient();
            httpclient.getConnectionManager().getSchemeRegistry().register(https);
            
            HttpHost target = new HttpHost(
                    LocalTestServer.TEST_SERVER_ADDR.getHostName(),
                    server.getServicePort(),
                    "https");
            HttpGet httpget = new HttpGet("/random/100");
            HttpResponse response = httpclient.execute(target, httpget);
            assertEquals(200, response.getStatusLine().getStatusCode());
            assertTrue(hostnameVerifier.isFired());
        } finally {
            server.stop();
        }
    }
#vulnerable code 
                                public void testCreateSocket() throws Exception {
        HttpParams params = new BasicHttpParams();
        String password = "changeit";
        char[] pwd = password.toCharArray();

        RSAPrivateCrtKeySpec k;
        k = new RSAPrivateCrtKeySpec(new BigInteger(RSA_PUBLIC_MODULUS, 16),
                                     new BigInteger(RSA_PUBLIC_EXPONENT, 10),
                                     new BigInteger(RSA_PRIVATE_EXPONENT, 16),
                                     new BigInteger(RSA_PRIME1, 16),
                                     new BigInteger(RSA_PRIME2, 16),
                                     new BigInteger(RSA_EXPONENT1, 16),
                                     new BigInteger(RSA_EXPONENT2, 16),
                                     new BigInteger(RSA_COEFFICIENT, 16));

        PrivateKey pk = KeyFactory.getInstance("RSA").generatePrivate(k);
        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(null, null);

        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        InputStream in1, in2, in3;
        in1 = new ByteArrayInputStream(X509_FOO);
        in2 = new ByteArrayInputStream(X509_INTERMEDIATE_CA);
        in3 = new ByteArrayInputStream(X509_ROOT_CA);
        X509Certificate[] chain = new X509Certificate[3];
        chain[0] = (X509Certificate) cf.generateCertificate(in1);
        chain[1] = (X509Certificate) cf.generateCertificate(in2);
        chain[2] = (X509Certificate) cf.generateCertificate(in3);

        ks.setKeyEntry("RSA_KEY", pk, pwd, chain);
        ks.setCertificateEntry("CERT", chain[2]); // Let's trust ourselves. :-)

        File tempFile = File.createTempFile("junit", "jks");
        try {
            String path = tempFile.getCanonicalPath();
            tempFile.deleteOnExit();
            FileOutputStream fOut = new FileOutputStream(tempFile);
            ks.store(fOut, pwd);
            fOut.close();

            System.setProperty("javax.net.ssl.keyStore", path);
            System.setProperty("javax.net.ssl.keyStorePassword", password);
            System.setProperty("javax.net.ssl.trustStore", path);
            System.setProperty("javax.net.ssl.trustStorePassword", password);

            ServerSocketFactory server = SSLServerSocketFactory.getDefault();
            // Let the operating system just choose an available port:
            ServerSocket serverSocket = server.createServerSocket(0);
            serverSocket.setSoTimeout(30000);
            int port = serverSocket.getLocalPort();
            // System.out.println("\nlistening on port: " + port);

            SSLSocketFactory ssf = SSLSocketFactory.getSocketFactory();
            ssf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

            // Test 1 - createSocket()
            IOException[] e = new IOException[1];
            boolean[] success = new boolean[1];
            listen(serverSocket, e, success);
            Socket s = ssf.connectSocket(null, "localhost", port,
                                         null, 0, params);
            exerciseSocket(s, e, success);

            // Test 2 - createSocket( Socket ), where we upgrade a plain socket
            //          to SSL.
            success[0] = false;
            listen(serverSocket, e, success);
            s = new Socket("localhost", port);
            s = ssf.createSocket(s, "localhost", port, true);
            exerciseSocket(s, e, success);
        }
        finally {
            tempFile.delete();
        }
    } 
                            #location 69 
                            #vulnerability type RESOURCE_LEAK