#vulnerable code 
                                @Test
    public void rendersReport() throws Exception {
        final Farm farm = new FtFarm(new PropsFarm(new FkFarm()));
        final Catalog catalog = new Catalog(new Pmo(farm)).bootstrap();
        final String pid = "A1B2C3DXF";
        catalog.add(pid, String.format("2017/10/%s/", pid));
        final Project project = farm.find(
            String.format("@id='%s'", pid)
        ).iterator().next();
        final Roles roles = new Roles(project).bootstrap();
        final String uid = "yegor256";
        roles.assign(uid, "PO");
        new People(new Pmo(farm)).bootstrap().invite(uid, "mentor");
        new ClaimOut()
            .type("Order was given")
            .param("login", uid)
            .postTo(project);
        final Take take = new TkApp(farm);
        MatcherAssert.assertThat(
            XhtmlMatchers.xhtml(
                new RsPrint(
                    take.act(
                        new RqWithHeaders(
                            new RqFake(
                                "GET",
                                String.format(
                                    "/report/%s?report=orders-given-by-week",
                                    pid
                                )
                            ),
                            // @checkstyle LineLength (1 line)
                            "Cookie: PsCookie=0975A5A5-F6DB193E-AF18000A-75726E3A-74657374-3A310005-6C6F6769-6E000879-65676F72-323536AE",
                            "Accept: application/xml"
                        )
                    )
                ).printBody()
            ),
            XhtmlMatchers.hasXPaths("/page/rows/row[week]")
        );
    } 
                            #location 40 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                @Test
    public void rendersReport() throws Exception {
        final Farm farm = new FtFarm(new PropsFarm(new FkFarm()));
        final String uid = "yegor256";
        new ClaimOut()
            .type("Order was given")
            .param("login", uid)
            .postTo(farm.find("@id='C00000000'").iterator().next());
        MatcherAssert.assertThat(
            XhtmlMatchers.xhtml(
                new RsPrint(
                    new TkApp(farm).act(
                        new RqWithHeaders(
                            new RqWithUser(
                                farm,
                                new RqFake(
                                    "GET",
                                    // @checkstyle LineLength (1 line)
                                    "/report/C00000000?report=orders-given-by-week"
                                )
                            ),
                            "Accept: application/xml"
                        )
                    )
                ).printBody()
            ),
            XhtmlMatchers.hasXPaths("/page/rows/row[week]")
        );
    }