output: #fixed code
                                protected static CharSequence encodeUriQuery(CharSequence in) {
      //Note that I can't simply use URI.java to encode because it will escape pre-existing escaped things.
      StringBuilder outBuf = null;
      Formatter formatter = null;
      for(int i = 0; i < in.length(); i++) {
        char c = in.charAt(i);
        boolean escape = true;
        if (c < 128) {
          if (asciiQueryChars.get((int)c)) {
            escape = false;
          }
        } else if (!Character.isISOControl(c) && !Character.isSpaceChar(c)) {//not-ascii
          escape = false;
        }
        if (!escape) {
          if (outBuf != null)
            outBuf.append(c);
        } else {
          //escape
          if (outBuf == null) {
            outBuf = new StringBuilder(in.length() + 5*3);
            outBuf.append(in,0,i);
            try {
              formatter = new Formatter(outBuf);
            } finally {
              if (formatter != null) {
                formatter.flush();
                formatter.close();
              } 
            }
          }
          //leading %, 0 padded, width 2, capital hex
          formatter.format("%%%02X",(int)c);//TODO
        }
      }
      return outBuf != null ? outBuf : in;
    }
input: #vulnerable code 
                                protected static CharSequence encodeUriQuery(CharSequence in) {
      //Note that I can't simply use URI.java to encode because it will escape pre-existing escaped things.
      StringBuilder outBuf = null;
      Formatter formatter = null;
      for(int i = 0; i < in.length(); i++) {
        char c = in.charAt(i);
        boolean escape = true;
        if (c < 128) {
          if (asciiQueryChars.get((int)c)) {
            escape = false;
          }
        } else if (!Character.isISOControl(c) && !Character.isSpaceChar(c)) {//not-ascii
          escape = false;
        }
        if (!escape) {
          if (outBuf != null)
            outBuf.append(c);
        } else {
          //escape
          if (outBuf == null) {
            outBuf = new StringBuilder(in.length() + 5*3);
            outBuf.append(in,0,i);
            formatter = new Formatter(outBuf);
          }
          //leading %, 0 padded, width 2, capital hex
          formatter.format("%%%02X",(int)c);//TODO
        }
      }
      return outBuf != null ? outBuf : in;
    } 
                              #location 29 
                              #vulnerability type RESOURCE_LEAK