output: #fixed code
                                public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain)
        throws IOException, ServletException {
      final HttpServletRequest request = (HttpServletRequest) req;
      final HttpServletResponse response = (HttpServletResponse) res;
      try {
        // add request, response & servletContext to thread local
        Context.set(Context.webContext(request, response, filterConfig));
        IOUtils.write("\nBefore chain!\n", response.getOutputStream());
        final ByteArrayOutputStream os = new ByteArrayOutputStream();
        System.out.println(response.getOutputStream());
        final HttpServletResponse wrappedResponse = new RedirectedStreamServletResponseWrapper(os, response);
        chain.doFilter(request, wrappedResponse); 
        final Reader reader = new StringReader(new String(os.toByteArray(), Context.get().getConfig().getEncoding()));
        
        doProcess(reader, new OutputStreamWriter(os));
        IOUtils.write(os.toByteArray(), response.getOutputStream());
        response.flushBuffer();
        response.getOutputStream().close();
      } catch (final RuntimeException e) {
        onRuntimeException(e, response, chain);
      } finally { 
        Context.unset();
      }
    }
input: #vulnerable code 
                                public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain)
        throws IOException, ServletException {
      final HttpServletRequest request = (HttpServletRequest) req;
      final HttpServletResponse response = (HttpServletResponse) res;
      try {
        // add request, response & servletContext to thread local
        Context.set(Context.webContext(request, response, filterConfig));
        final ByteArrayOutputStream os = new ByteArrayOutputStream();
        HttpServletResponse wrappedResponse = new RedirectedStreamServletResponseWrapper(os, response);
        
        chain.doFilter(req, wrappedResponse);
        final Reader reader = new StringReader(new String(os.toByteArray(), Context.get().getConfig().getEncoding()));
        doProcess(reader, response.getWriter());
        response.flushBuffer();
      } catch (final RuntimeException e) {
        onRuntimeException(e, response, chain);
      } finally { 
        Context.unset();
      }
    } 
                              #location 11 
                              #vulnerability type RESOURCE_LEAK