Program: 8976
Project: 8976
Buggy source:
@Nonnull private String buildXPathStatement(@Nonnull String relPath,@Nullable String value,@Nonnull AuthorizableType type,boolean exact){
  StringBuilder stmt=new StringBuilder();
  String searchRoot=namePathMapper.getJcrPath(QueryUtil.getSearchRoot(type,config));
  if (!"String_Node_Str".equals(searchRoot)) {
    stmt.append(searchRoot);
  }
  String propName;
  String path;
  String ntName;
  if (relPath.indexOf('/') == -1) {
    propName=relPath;
    path=null;
    ntName=null;
  }
 else {
    propName=Text.getName(relPath);
    String[] segments=Text.explode(relPath,'/',false);
    StringBuilder sb=new StringBuilder();
    for (int i=0; i < segments.length - 1; i++) {
      if (!PathUtils.denotesCurrent(segments[i])) {
        if (i > 0) {
          sb.append('/');
        }
        sb.append(segments[i]);
      }
    }
    path=Strings.emptyToNull(sb.toString());
    ntName=namePathMapper.getJcrName(QueryUtil.getNodeTypeName(type));
  }
  stmt.append("String_Node_Str");
  if (path != null) {
    stmt.append(path);
  }
 else   if (ntName != null) {
    stmt.append("String_Node_Str").append(ntName).append(')');
  }
 else {
    stmt.append("String_Node_Str");
  }
  if (value == null) {
    stmt.append("String_Node_Str").append(propName).append(']');
  }
 else {
    stmt.append('[');
    stmt.append((exact) ? "String_Node_Str" : "String_Node_Str");
    stmt.append(ISO9075.encode(propName));
    if (exact) {
      stmt.append("String_Node_Str");
      stmt.append(value.replaceAll("String_Node_Str","String_Node_Str"));
      stmt.append('\'');
    }
 else {
      stmt.append("String_Node_Str");
      stmt.append(QueryUtil.escapeForQuery(value));
      stmt.append("String_Node_Str");
    }
    stmt.append(']');
  }
  return stmt.toString();
}

Fixed version (ground truth):
@Nonnull private String buildXPathStatement(@Nonnull XPathQueryBuilder builder) throws RepositoryException {
  Condition condition=builder.getCondition();
  String sortCol=builder.getSortProperty();
  QueryBuilder.Direction sortDir=builder.getSortDirection();
  Value bound=builder.getBound();
  if (bound != null) {
    if (sortCol == null) {
      log.warn("String_Node_Str");
    }
 else {
      Condition boundCondition=builder.property(sortCol,QueryUtil.getCollation(sortDir),bound);
      if (condition == null) {
        condition=boundCondition;
      }
 else {
        condition=builder.and(condition,boundCondition);
      }
    }
  }
  StringBuilder statement=new StringBuilder();
  ConditionVisitor visitor=new XPathConditionVisitor(statement,namePathMapper,userManager);
  String searchRoot=namePathMapper.getJcrPath(QueryUtil.getSearchRoot(builder.getSelectorType(),config));
  String ntName=namePathMapper.getJcrName(QueryUtil.getNodeTypeName(builder.getSelectorType()));
  statement.append(searchRoot).append("String_Node_Str").append(ntName).append(')');
  if (condition != null) {
    statement.append('[');
    condition.accept(visitor);
    statement.append(']');
  }
  if (sortCol != null) {
    boolean ignoreCase=builder.getSortIgnoreCase();
    statement.append("String_Node_Str");
    if (ignoreCase) {
      statement.append("String_Node_Str").append(sortCol).append(')');
    }
 else {
      statement.append(sortCol);
    }
    statement.append(' ').append(sortDir.getDirection());
  }
  return statement.toString();
}