anon-iclr-submission/benchname-bug-localization huggingface dataset:
Repository: gluufederation/oxauth
Issue: Fix the list of scopes in the authorization page

A dynamically registered client only gets the `openid` scope. Yet oxAuth is prompting for release of scopes like `profile` and `email` based on client request.   Although data is not being leaked, it oxAuth is presenting the wrong authorization message to the user.

We should also add a _**negative test**_ to reflect the above case.



Changed files:
Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java

diff --git a/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java b/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java
index 8e847f619..b504f159b 100644
--- a/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java
+++ b/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java
@@ -6,24 +6,24 @@
 
 package org.xdi.oxauth.model.authorize;
 
-import java.util.HashSet;
-import java.util.Set;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.xdi.oxauth.model.registration.Client;
 import org.xdi.oxauth.service.ScopeService;
 
+import javax.ejb.Stateless;
+import javax.inject.Inject;
+import javax.inject.Named;
+import java.util.HashSet;
+import java.util.Set;
+
 /**
  * Validates the scopes received for the authorize web service.
  *
  * @author Yuriy Zabrovarnyy
  * @author Yuriy Movchan
- * @version June 3, 2015
+ * @author Javier Rojas Blum
+ * @version January 30, 2018
  */
 @Stateless
 @Named("scopeChecker")
@@ -39,6 +39,10 @@ public class ScopeChecker {
         log.debug("Checking scopes policy for: " + scope);
         Set<String> grantedScopes = new HashSet<String>();
 
+        if (scope == null || client == null) {
+            return grantedScopes;
+        }
+
         final String[] scopesRequested = scope.split(" ");
         final String[] scopesAllowed = client.getScopes();
Repository: gluufederation/oxauth
Issue: test(oxauth): SpontaneousScopeHttpTest fails during build

## Describe the issue

```
at org.testng.Assert.fail(Assert.java:96)
at org.testng.Assert.failNotEquals(Assert.java:776)
at org.testng.Assert.assertTrue(Assert.java:44)
at org.testng.Assert.assertTrue(Assert.java:54)
at org.gluu.oxauth.ws.rs.SpontaneousScopeHttpTest.spontaneousScope(SpontaneousScopeHttpTest.java:54)
```

## Steps To Reproduce
Run build with tests

## Expected behavior
Test must pass.

## Actual behavior
Fails.



Changed files:
Model/src/main/java/org/gluu/oxauth/model/configuration/AppConfiguration.java

diff --git a/Model/src/main/java/org/gluu/oxauth/model/configuration/AppConfiguration.java b/Model/src/main/java/org/gluu/oxauth/model/configuration/AppConfiguration.java
index 76fd97c4e..82498084b 100644
--- a/Model/src/main/java/org/gluu/oxauth/model/configuration/AppConfiguration.java
+++ b/Model/src/main/java/org/gluu/oxauth/model/configuration/AppConfiguration.java
@@ -70,7 +70,7 @@ public class AppConfiguration implements Configuration {
     private int statTimerIntervalInSeconds;
     private int statWebServiceIntervalLimitInSeconds;
 
-    private Boolean allowSpontaneousScopes;
+    private Boolean allowSpontaneousScopes = true;
     private int spontaneousScopeLifetime;
     private String openidSubAttribute;
     private Set<Set<ResponseType>> responseTypesSupported;
@@ -1215,7 +1215,7 @@ public class AppConfiguration implements Configuration {
     }
 
     public Boolean getAllowSpontaneousScopes() {
-        if (allowSpontaneousScopes == null) allowSpontaneousScopes = false;
+        if (allowSpontaneousScopes == null) allowSpontaneousScopes = true;
         return allowSpontaneousScopes;
     }
Repository: gluufederation/oxauth
Issue: bug(oxauth): fix NPE in JwtAuthorizationRequest

## Describe the issue
```
java.lang.NullPointerException: null
        at org.gluu.oxauth.model.authorize.JwtAuthorizationRequest.createJwtRequest(JwtAuthorizationRequest.java:466) ~[classes/:?]
        at org.gluu.oxauth.bcauthorize.ws.rs.BackchannelAuthorizeRestWebServiceImpl.requestBackchannelAuthorizationPost(BackchannelAuthorizeRestWebServiceImpl.java:167) ~[classes/:?]
        at org.gluu.oxauth.bcauthorize.ws.rs.BackchannelAuthorizeRestWebServiceImpl$Proxy$_$$_WeldClientProxy.requestBackchannelAuthorizationPost(Unknown Source) ~[classes/:?]
        at jdk.internal.reflect.GeneratedMethodAccessor660.invoke(Unknown Source) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
```

## Expected behavior
There must not be NPE.

## Actual behavior
NPE if redirect response is null.


Changed files:
Server/src/main/java/org/gluu/oxauth/model/authorize/JwtAuthorizationRequest.java

diff --git a/Server/src/main/java/org/gluu/oxauth/model/authorize/JwtAuthorizationRequest.java b/Server/src/main/java/org/gluu/oxauth/model/authorize/JwtAuthorizationRequest.java
index 72773d939..2e1dfb565 100644
--- a/Server/src/main/java/org/gluu/oxauth/model/authorize/JwtAuthorizationRequest.java
+++ b/Server/src/main/java/org/gluu/oxauth/model/authorize/JwtAuthorizationRequest.java
@@ -463,7 +463,7 @@ public class JwtAuthorizationRequest {
     }
 
     public static JwtAuthorizationRequest createJwtRequest(String request, String requestUri, Client client, RedirectUriResponse redirectUriResponse, AbstractCryptoProvider cryptoProvider, AppConfiguration appConfiguration) {
-        validateRequestUri(requestUri, client, appConfiguration, redirectUriResponse.getState());
+        validateRequestUri(requestUri, client, appConfiguration, redirectUriResponse != null ? redirectUriResponse.getState() : null);
         final String requestFromClient = queryRequest(requestUri, redirectUriResponse, appConfiguration);
         if (StringUtils.isNotBlank(requestFromClient)) {
             request = requestFromClient;