#vulnerable code 
                              public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain)
      throws IOException, ServletException {
    final HttpServletRequest request = (HttpServletRequest) req;
    final HttpServletResponse response = (HttpServletResponse) res;
    try {
      // add request, response & servletContext to thread local
      Context.set(Context.webContext(request, response, filterConfig));
      final ByteArrayOutputStream os = new ByteArrayOutputStream();
      HttpServletResponse wrappedResponse = new RedirectedStreamServletResponseWrapper(os, response);
      
      chain.doFilter(req, wrappedResponse);
      final Reader reader = new StringReader(new String(os.toByteArray(), Context.get().getConfig().getEncoding()));
      doProcess(reader, response.getWriter());
      response.flushBuffer();
    } catch (final RuntimeException e) {
      onRuntimeException(e, response, chain);
    } finally { 
      Context.unset();
    }
  } 
                            #location 11 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                              public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain)
      throws IOException, ServletException {
    final HttpServletRequest request = (HttpServletRequest) req;
    final HttpServletResponse response = (HttpServletResponse) res;
    try {
      // add request, response & servletContext to thread local
      Context.set(Context.webContext(request, response, filterConfig));
      IOUtils.write("\nBefore chain!\n", response.getOutputStream());
      final ByteArrayOutputStream os = new ByteArrayOutputStream();
      System.out.println(response.getOutputStream());
      final HttpServletResponse wrappedResponse = new RedirectedStreamServletResponseWrapper(os, response);
      chain.doFilter(request, wrappedResponse); 
      final Reader reader = new StringReader(new String(os.toByteArray(), Context.get().getConfig().getEncoding()));
      
      doProcess(reader, new OutputStreamWriter(os));
      IOUtils.write(os.toByteArray(), response.getOutputStream());
      response.flushBuffer();
      response.getOutputStream().close();
    } catch (final RuntimeException e) {
      onRuntimeException(e, response, chain);
    } finally { 
      Context.unset();
    }
  }