import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.Cookie;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;

public boolean validateCsrfTokenInRequest(HttpServletRequest request) {
	  if (cookies != null) {
		for (Cookie cookie : cookies) {
			if (cookie.getName().equals(CSRF-TOKEN){
				csrfCookieValue = cookie.getValue();
			}
		}
	  }
          if (UnsafecsrfComparison(csrfCookieValue)) { // BAD
                return true;      
          }
}
private boolean UnsafecsrfComparison(String csrfTokenInCookie) {
         if(csrfTokenInCookie == null || !csrfTokenInCookie.equals(request.getHeader("X-CSRF-TOKEN"))) { // BAD
                 return false;
         }
}

			    
			    
public boolean validateCsrfTokenInRequest(HttpServletRequest request) {
	  if (cookies != null) {
		for (Cookie cookie : cookies) {
			if (cookie.getName().equals(CSRF-TOKEN){
				csrfCookieValue = cookie.getValue();
			}
		}
	  }
          if (safecsrfComparison(csrfCookieValue)) { // GOOD
                return true;      
          }
}
private boolean safecsrfComparison(String csrfTokenInCookie) {
	  String csrfTokenInRequest = request.getHeader("X-CSRF-TOKEN");
          if (csrfTokenInRequest == null || !MessageDigest.isEqual(
                csrfTokenInCookie.getBytes(StandardCharsets.UTF_8), 
                csrfTokenInRequest.getBytes(StandardCharsets.UTF_8))) { // GOOD
                     return false;
         }
}

@@ -43,42 +43,8 @@
 st;%0A
-import javax.servlet.http.Cookie;%0A
 impo
@@ -122,928 +122,231 @@
 t;%0A%0A
-public boolean validateCsrfTokenInRequest(HttpServletRequest request) %7B%0A%09  if (cookies != null) %7B%0A%09%09for (Cookie cookie : cookies) %7B%0A%09%09%09if (cookie.getName().equals(CSRF-TOKEN)%7B%0A%09%09%09%09csrfCookieValue = cookie.getValue();%0A%09%09%09%7D%0A%09%09%7D%0A%09  %7D%0A          if (UnsafecsrfComparison(csrfCookieValue)) %7B // BAD%0A                return true;      %0A          %7D%0A%7D%0Aprivate boolean UnsafecsrfComparison(String csrfTokenInCookie) %7B%0A         if(csrfTokenInCookie == null %7C%7C !csrfTokenInCookie.equals(request.getHeader(%22X-CSRF-TOKEN%22))) %7B // BAD%0A                 return false;%0A         %7D%0A%7D%0A%0A%09%09%09    %0A%09%09%09    %0Apublic boolean validateCsrfTokenInRequest(HttpServletRequest request) %7B%0A%09  if (cookies != null) %7B%0A%09%09for (Cookie cookie : cookies) %7B%0A%09%09%09if (cookie.getName().equals(CSRF-TOKEN)%7B%0A%09%09%09%09csrfCookieValue = cookie.getValue();%0A%09%09%09%7D%0A%09%09%7D%0A%09  %7D%0A          if (safecsrfComparison(csrfCookieValue)) %7B // GOOD%0A                return true;      %0A          %7D%0A%7D
+%0Aprivate boolean UnsafecsrfComparison(String csrfTokenInCookie) %7B%0A         if(csrfTokenInCookie == null %7C%7C !csrfTokenInCookie.equals(request.getHeader(%22X-CSRF-TOKEN%22))) %7B // BAD%0A                 return false;%0A         %7D%0A%7D%0A%0A
 %0Apri

Update csrfComparison.java