#vulnerable code 
                                @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        String authCode = req.getParameter("code");
        
        String uri = "http://localhost:9090/auth/realms/master/protocol/openid-connect/token";
        URL url = new URL(uri);
        HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();

        urlConnection.setRequestMethod("POST");

        String urlParameters = "grant_type=authorization_code&code=" + authCode + "&client_id=console&redirect_uri=" + callbackUrl;
        
        // Send post request
        urlConnection.setDoOutput(true);
        DataOutputStream outputStream = new DataOutputStream(urlConnection.getOutputStream());
        outputStream.writeBytes(urlParameters);
        outputStream.flush();
        outputStream.close();

        int responseCode = urlConnection.getResponseCode();

        BufferedReader inputReader = new BufferedReader(new InputStreamReader(urlConnection.getInputStream()));

        // parse result
        JsonReader jsonReader = Json.createReader(inputReader);

        // Parse json response
        JsonObject jsonObject = jsonReader.readObject();
        inputReader.close();

        // Get and clean jwks_uri property
        String accessToken = jsonObject.getString("access_token");
        
        resp.sendRedirect("http://localhost:8889/console.jsp?gwt.codesvr=127.0.0.1:9997&access_token=" + accessToken);
    } 
                            #location 36 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        ConsoleSetting settings = ConsoleSetting.getInstance();
        
        String authCode = req.getParameter("code");
        
        String uri = settings.getString(ConsoleSettingKeys.SSO_OPENID_SERVER_ENDPOINT_TOKEN);
        URL url = new URL(uri);
        HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection();

        urlConnection.setRequestMethod("POST");

        String urlParameters = "grant_type=authorization_code&code=" + authCode + "&client_id=" + settings.getString(ConsoleSettingKeys.SSO_OPENID_CLIENT_ID) + "&redirect_uri=" + settings.getString(ConsoleSettingKeys.SSO_OPENID_REDIRECT_URI);
        
        // Send post request
        urlConnection.setDoOutput(true);
        DataOutputStream outputStream = new DataOutputStream(urlConnection.getOutputStream());
        outputStream.writeBytes(urlParameters);
        outputStream.flush();
        outputStream.close();

        BufferedReader inputReader = new BufferedReader(new InputStreamReader(urlConnection.getInputStream()));

        // parse result
        JsonReader jsonReader = Json.createReader(inputReader);

        // Parse json response
        JsonObject jsonObject = jsonReader.readObject();
        inputReader.close();

        // Get and clean jwks_uri property
        String accessToken = jsonObject.getString("access_token");
        String baseUri = settings.getString(ConsoleSettingKeys.SITE_HOME_URI);
        String separator = baseUri.contains("?") ? "&" : "?";
        resp.sendRedirect(baseUri + separator + "access_token=" + accessToken);
    }