#vulnerable code 
                                private byte[] buildFakePluginJar() throws IOException {
        ClassLoader cl = getClass().getClassLoader();

        ByteArrayOutputStream buffer = new ByteArrayOutputStream();
        JarOutputStream jar = new JarOutputStream(buffer);

        //Add files to the jar stream
        for (String resource : Arrays.asList("findbugs.xml", "messages.xml", "META-INF/MANIFEST.MF")) {
            jar.putNextEntry(new ZipEntry(resource));
            jar.write(IOUtils.toByteArray(cl.getResourceAsStream("metadata/" + resource)));
        }
        jar.finish();

        return buffer.toByteArray();
    } 
                            #location 14 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                private byte[] buildFakePluginJar() throws IOException, URISyntaxException {
        ClassLoader cl = getClass().getClassLoader();

        ByteArrayOutputStream buffer = new ByteArrayOutputStream();
        JarOutputStream jar = new JarOutputStream(buffer);

        final URL metadata = cl.getResource("metadata");
        if (metadata != null) {
            final File dir = new File(metadata.toURI());
            
            //Add files to the jar stream
            addFilesToStream(cl, jar, dir, "");
        }
        jar.finish();
        jar.close();

        return buffer.toByteArray();
    }