#vulnerable code 
                                private JSONObject responseFor(String path, String ip_address)
            throws GeoIP2Exception {
        DefaultHttpClient httpclient = new DefaultHttpClient();
        try {
            // String uri = "https://ct4-test.maxmind.com/geoip/" + path + "/" +
            // ip_address;
            String uri = "https://" + host;
            if (host.startsWith("localhost")) {
                uri = "http://" + host;
            }
            uri = uri + "/geoip/v2.0/" + path + "/" + ip_address;
            HttpGet httpget = new HttpGet(uri);
            httpget.addHeader("Accept", "application/json");
            httpget.addHeader(BasicScheme.authenticate(
                    new UsernamePasswordCredentials(userId, licenseKey),
                    "UTF-8", false));
            HttpResponse response = httpclient.execute(httpget);
            int status = response.getStatusLine().getStatusCode();
            if (status == 200) {
                return handleSuccess(response, uri);
            } else {
                handleErrorStatus(response, status, uri);
            }
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            httpclient.getConnectionManager().shutdown();
        }
        return null;
    } 
                            #location 27 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                private JSONObject responseFor(String path, String ip_address)
            throws GeoIP2Exception {
        DefaultHttpClient httpclient = new DefaultHttpClient();
        String uri = "https://" + host;
        if (host.startsWith("localhost")) {
            uri = "http://" + host;
        }
        uri = uri + "/geoip/v2.0/" + path + "/" + ip_address;
        HttpGet httpget = new HttpGet(uri);
        httpget.addHeader("Accept", "application/json");
        httpget.addHeader(BasicScheme.authenticate(
                new UsernamePasswordCredentials(userId, licenseKey), "UTF-8",
                false));
        HttpResponse response = null;
        try {
            response = httpclient.execute(httpget);
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            httpclient.getConnectionManager().shutdown();
        }

        int status = response.getStatusLine().getStatusCode();
        if (status == 200) {
            return handleSuccess(response, uri);
        } else {
            handleErrorStatus(response, status, uri);
        }
        return null;
    }