CWE-565: Reliance on Cookies Without Validation and Integrity CheckingOpens in a new tab

I was working on this excercise

CWE-565: Reliance on Cookies Without Validation and Integrity CheckingOpens in a new tain find the Flaw: Java – Software and Data Integrity Failures

Theory lab

even after selecting the correct vuln name and the code lines, it is showing as incorrect line selected, please assist me on this 

code

Find the Flaw: Java – Software and Data Integrity Failures (AIG Refresh)

Theory lab

Select the line numbers containing the vulnerable code, then select the correct CWE identifier for the vulnerability.

Incorrect

Reset selection

Selected lines: ??

Select a Vulnerability

Select a VulnerabilityCWE-276: Incorrect Default PermissionsCWE-565: Reliance on Cookies without Validation and Integrity CheckingCWE-502: Deserialization of Untrusted Data CWE-915: Improperly Controlled Modification of Dynamically-Determined Object AttributesCWE-829: Inclusion of Functionality from Untrusted Control Sphere CWE-280: Improper Handling of Insufficient Permissions or PrivilegesCWE-353: Missing Support for Integrity Check CWE-494: Download of Code Without Integrity Check

@WebServlet("/checkout")

public class CheckoutServlet extends HttpServlet {

@Override

protected void doGet(HttpServletRequest req, HttpServletResponse resp)

throws ServletException, IOException {HttpSession session = req.getSession(false);

Long userId = (Long) session.getAttribute("userId");

User user = userService.findById(userId);

if (user == null) {

resp.sendError(HttpServletResponse.SC_NOT_FOUND,"User not found");

return;}

Basket basket = basketService.findByUserId(userId);

if (basket == null || basket.getItems().isEmpty()) {

resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Basket is empty");

return;}

double totalCost = 0;

for (Item item : basket.getItems()) {

totalCost += (item.getCost() * item.getQuantity());

}

Cookie[] cookies = req.getCookies();

double discount = 0;

if (cookies != null) {

for (Cookie cookie : cookies) {

if (cookie.getName().equals("applyDiscount")) {

try{

discount = Double.parseDouble(cookie.getValue());

} catch(NumberFormatException e){

resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid discount");

return;}

break;}

}
}

totalCost -= (totalCost * (discount / 100));

resp.setContentType("application/json");

resp.getWriter().write("{\"totalCost\":" + totalCost + "}");

}

}