Program: 166456
Project: 166456
Buggy source:
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  String sourceUrl=(String)request.getAttribute(AbstractGatewayFilter.SOURCE_REQUEST_CONTEXT_URL_ATTRIBUTE_NAME);
  String topologyName=getTopologyName(sourceUrl);
  String serviceName=getServiceName();
  Subject subject=Subject.getSubject(AccessController.getContext());
  Principal primaryPrincipal=(Principal)subject.getPrincipals(PrimaryPrincipal.class).toArray()[0];
  String primaryUser=primaryPrincipal.getName();
  String impersonatedUser=null;
  Object[] impersonations=subject.getPrincipals(ImpersonatedPrincipal.class).toArray();
  if (impersonations != null && impersonations.length > 0) {
    impersonatedUser=((Principal)impersonations[0]).getName();
  }
  String user=(impersonatedUser != null) ? impersonatedUser : primaryUser;
  if (LOG.isDebugEnabled()) {
    LOG.debug("String_Node_Str" + primaryUser + "String_Node_Str"+ impersonatedUser+ "String_Node_Str"+ user);
  }
  Object[] groupObjects=subject.getPrincipals(GroupPrincipal.class).toArray();
  Set<String> groups=new HashSet<String>();
  for (  Object obj : groupObjects) {
    groups.add(((Principal)obj).getName());
  }
  String clientIp=request.getRemoteAddr();
  if (LOG.isDebugEnabled()) {
    LOG.debug("String_Node_Str" + primaryUser + "String_Node_Str"+ impersonatedUser+ "String_Node_Str"+ user+ "String_Node_Str"+ groups+ "String_Node_Str"+ clientIp);
  }
  RangerAccessRequest accessRequest=new KnoxRangerPlugin.RequestBuilder().service(serviceName).topology(topologyName).user(user).groups(groups).clientIp(clientIp).build();
  RangerAccessResult result=plugin.isAccessAllowed(accessRequest);
  boolean accessAllowed=result.getIsAllowed();
  boolean audited=result.getIsAudited();
  if (LOG.isDebugEnabled()) {
    LOG.debug("String_Node_Str" + accessAllowed);
    LOG.debug("String_Node_Str" + audited);
  }
  if (accessAllowed) {
    chain.doFilter(request,response);
  }
 else {
    sendForbidden((HttpServletResponse)response);
  }
}

Fixed version (ground truth):
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  String sourceUrl=(String)request.getAttribute(AbstractGatewayFilter.SOURCE_REQUEST_CONTEXT_URL_ATTRIBUTE_NAME);
  String topologyName=getTopologyName(sourceUrl);
  String serviceName=getServiceName();
  Subject subject=Subject.getSubject(AccessController.getContext());
  Principal primaryPrincipal=(Principal)subject.getPrincipals(PrimaryPrincipal.class).toArray()[0];
  String primaryUser=primaryPrincipal.getName();
  String impersonatedUser=null;
  Object[] impersonations=subject.getPrincipals(ImpersonatedPrincipal.class).toArray();
  if (impersonations != null && impersonations.length > 0) {
    impersonatedUser=((Principal)impersonations[0]).getName();
  }
  String user=(impersonatedUser != null) ? impersonatedUser : primaryUser;
  if (LOG.isDebugEnabled()) {
    LOG.debug("String_Node_Str" + primaryUser + "String_Node_Str"+ impersonatedUser+ "String_Node_Str"+ user);
  }
  Object[] groupObjects=subject.getPrincipals(GroupPrincipal.class).toArray();
  Set<String> groups=new HashSet<String>();
  for (  Object obj : groupObjects) {
    groups.add(((Principal)obj).getName());
  }
  String clientIp=request.getRemoteAddr();
  if (LOG.isDebugEnabled()) {
    LOG.debug("String_Node_Str" + primaryUser + "String_Node_Str"+ impersonatedUser+ "String_Node_Str"+ user+ "String_Node_Str"+ groups+ "String_Node_Str"+ clientIp);
  }
  RangerAccessRequest accessRequest=new KnoxRangerPlugin.RequestBuilder().service(serviceName).topology(topologyName).user(user).groups(groups).clientIp(clientIp).build();
  RangerAccessResult result=plugin.isAccessAllowed(accessRequest);
  boolean accessAllowed=result != null && result.getIsAllowed();
  boolean audited=result != null && result.getIsAudited();
  if (LOG.isDebugEnabled()) {
    LOG.debug("String_Node_Str" + accessAllowed);
    LOG.debug("String_Node_Str" + audited);
  }
  if (accessAllowed) {
    chain.doFilter(request,response);
  }
 else {
    sendForbidden((HttpServletResponse)response);
  }
}