Program: 32304
Project: 32304
Buggy source:
public ApiServer(String ip,int port,IBurpExtenderCallbacks callbacks){
  IExtensionHelpers helpers=callbacks.getHelpers();
  PrintWriter stdout=new PrintWriter(callbacks.getStdout());
  PrintWriter stderr=new PrintWriter(callbacks.getStderr());
  setPort(port);
  setIpAddress(ip);
  BScanQueue scanQueue=BScanQueueFactory.create();
  Gson gson=new Gson();
  before((request,response) -> {
    String contentType=request.headers("String_Node_Str");
    if (!request.requestMethod().equals("String_Node_Str") && (contentType == null || !contentType.contains("String_Node_Str"))) {
      halt(400);
    }
  }
);
  get("String_Node_Str",(request,response) -> {
    try {
      URL url=new URL(new String(Base64.decodeBase64(request.params("String_Node_Str"))));
      if (callbacks.isInScope(url)) {
        response.status(200);
        return "String_Node_Str";
      }
 else {
        response.status(404);
        return "String_Node_Str";
      }
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  post("String_Node_Str",(request,response) -> {
    try {
      BURLMessage message=gson.fromJson(request.body(),BURLMessage.class);
      callbacks.includeInScope(new URL(message.url));
      response.status(201);
      return gson.toJson(message);
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  delete("String_Node_Str",(request,response) -> {
    try {
      URL url=new URL(new String(Base64.decodeBase64(request.params("String_Node_Str"))));
      callbacks.excludeFromScope(url);
      response.status(200);
      return "String_Node_Str";
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  get("String_Node_Str",(request,response) -> {
    IScanIssue[] rawIssues=callbacks.getScanIssues("String_Node_Str");
    List<BScanIssue> issues=new ArrayList<>();
    for (    IScanIssue issue : rawIssues) {
      issues.add(BScanIssueFactory.create(issue,callbacks));
    }
    return gson.toJson(new BArrayWrapper(issues));
  }
);
  get("String_Node_Str",(request,response) -> {
    byte[] encodedBytes=Base64.decodeBase64(request.params("String_Node_Str"));
    IScanIssue[] rawIssues=callbacks.getScanIssues(new String(encodedBytes));
    List<BScanIssue> issues=new ArrayList<>();
    for (    IScanIssue issue : rawIssues) {
      issues.add(BScanIssueFactory.create(issue,callbacks));
    }
    return gson.toJson(issues);
  }
);
  post("String_Node_Str",(request,response) -> {
    BScanIssue issue=gson.fromJson(request.body(),BScanIssue.class);
    callbacks.addScanIssue(issue);
    response.status(201);
    return gson.toJson(issue);
  }
);
  post("String_Node_Str",(request,response) -> {
    BURLMessage message=gson.fromJson(request.body(),BURLMessage.class);
    try {
      callbacks.sendToSpider(new URL(message.url));
      response.status(200);
      return "String_Node_Str";
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  get("String_Node_Str",(request,response) -> {
    List<BCookie> cookies=new ArrayList<>();
    for (    ICookie burpCookie : callbacks.getCookieJarContents()) {
      BCookie cookie=new BCookie();
      cookie.expiration=burpCookie.getExpiration();
      cookie.domain=burpCookie.getDomain();
      cookie.name=burpCookie.getName();
      cookie.value=burpCookie.getValue();
      cookies.add(cookie);
    }
    return gson.toJson(new BArrayWrapper(cookies));
  }
);
  post("String_Node_Str",(request,response) -> {
    BCookie cookie=gson.fromJson(request.body(),BCookie.class);
    callbacks.updateCookieJar(new ICookie(){
      @Override public String getDomain(){
        return cookie.domain;
      }
      @Override public Date getExpiration(){
        return cookie.expiration;
      }
      @Override public String getName(){
        return cookie.name;
      }
      @Override public String getValue(){
        return cookie.value;
      }
    }
);
    response.status(201);
    return gson.toJson(cookie);
  }
);
  post("String_Node_Str",(request,response) -> {
    BScanMessage message=gson.fromJson(request.body(),BScanMessage.class);
    IScanQueueItem item=callbacks.doActiveScan(message.host,message.port,message.useHttps,message.request);
    BScanQueueID id=scanQueue.addToQueue(item);
    response.status(201);
    return gson.toJson(id);
  }
);
  get("String_Node_Str",(request,response) -> {
    int id=Integer.parseInt(request.params("String_Node_Str"));
    IScanQueueItem item=scanQueue.getItem(id);
    if (item == null) {
      response.status(404);
      return "String_Node_Str";
    }
    response.status(200);
    BScanQueueItem bScanQueueItem=BScanQueueItemFactory.create(id,item,callbacks);
    return gson.toJson(bScanQueueItem);
  }
);
  delete("String_Node_Str",(request,response) -> {
    int id=Integer.parseInt(request.params("String_Node_Str"));
    IScanQueueItem item=scanQueue.getItem(id);
    if (item == null) {
      response.status(404);
      return "String_Node_Str";
    }
    response.status(200);
    item.cancel();
    scanQueue.removeFromQueue(id);
    return "String_Node_Str";
  }
);
  post("String_Node_Str",(request,response) -> {
    BScanMessage message=gson.fromJson(request.body(),BScanMessage.class);
    callbacks.doPassiveScan(message.host,message.port,message.useHttps,message.request,message.response);
    response.status(201);
    return "String_Node_Str";
  }
);
  post("String_Node_Str",(request,response) -> {
    String tool=request.params("String_Node_Str");
    BScanMessage message=gson.fromJson(request.body(),BScanMessage.class);
switch (tool) {
case "String_Node_Str":
      callbacks.sendToIntruder(message.host,message.port,message.useHttps,message.request);
    response.status(201);
  break;
case "String_Node_Str":
callbacks.sendToRepeater(message.host,message.port,message.useHttps,message.request,"String_Node_Str");
response.status(201);
break;
default :
response.status(404);
break;
}
return "String_Node_Str";
}
);
post("String_Node_Str",(request,response) -> {
callbacks.issueAlert(gson.fromJson(request.body(),BMessage.class).message);
response.status(201);
return "String_Node_Str";
}
);
post("String_Node_Str",(request,response) -> {
stdout.println(gson.fromJson(request.body(),BMessage.class).message);
response.status(201);
return "String_Node_Str";
}
);
post("String_Node_Str",(request,response) -> {
stderr.println(gson.fromJson(request.body(),BMessage.class).message);
response.status(201);
return "String_Node_Str";
}
);
get("String_Node_Str",(request,response) -> {
List<BHttpRequestResponse> pairs=new ArrayList<>();
for (IHttpRequestResponse requestResponse : callbacks.getSiteMap("String_Node_Str")) {
pairs.add(BHttpRequestResponseFactory.create(requestResponse,callbacks,helpers));
}
return gson.toJson(new BArrayWrapper(pairs));
}
);
get("String_Node_Str",(request,response) -> {
byte[] encodedBytes=Base64.decodeBase64(request.params("String_Node_Str"));
List<BHttpRequestResponse> pairs=new ArrayList<>();
for (IHttpRequestResponse requestResponse : callbacks.getSiteMap(new String(encodedBytes))) {
pairs.add(BHttpRequestResponseFactory.create(requestResponse,callbacks,helpers));
}
return gson.toJson(new BArrayWrapper(pairs));
}
);
post("String_Node_Str",(request,response) -> {
BHttpRequestResponse bHttpRequestResponse=gson.fromJson(request.body(),BHttpRequestResponse.class);
callbacks.addToSiteMap(bHttpRequestResponse);
response.status(201);
return gson.toJson(bHttpRequestResponse);
}
);
get("String_Node_Str",(request,response) -> {
List<BHttpRequestResponse> pairs=new ArrayList<>();
for (IHttpRequestResponse requestResponse : callbacks.getProxyHistory()) {
pairs.add(BHttpRequestResponseFactory.create(requestResponse,callbacks,helpers));
}
return gson.toJson(new BArrayWrapper(pairs));
}
);
}

Fixed version (ground truth):
public ApiServer(String ip,int port,IBurpExtenderCallbacks callbacks){
  IExtensionHelpers helpers=callbacks.getHelpers();
  PrintWriter stdout=new PrintWriter(callbacks.getStdout());
  PrintWriter stderr=new PrintWriter(callbacks.getStderr());
  setPort(port);
  setIpAddress(ip);
  BScanQueue scanQueue=BScanQueueFactory.create();
  Gson gson=new Gson();
  before((request,response) -> {
    String contentType=request.headers("String_Node_Str");
    if (!request.requestMethod().equals("String_Node_Str") && (contentType == null || !contentType.contains("String_Node_Str"))) {
      halt(400);
    }
  }
);
  get("String_Node_Str",(request,response) -> {
    try {
      URL url=new URL(new String(Base64.decodeBase64(request.params("String_Node_Str"))));
      if (callbacks.isInScope(url)) {
        response.status(200);
        return "String_Node_Str";
      }
 else {
        response.status(404);
        return "String_Node_Str";
      }
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  post("String_Node_Str",(request,response) -> {
    try {
      BURLMessage message=gson.fromJson(request.body(),BURLMessage.class);
      callbacks.includeInScope(new URL(message.url));
      response.status(201);
      return gson.toJson(message);
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  delete("String_Node_Str",(request,response) -> {
    try {
      URL url=new URL(new String(Base64.decodeBase64(request.params("String_Node_Str"))));
      callbacks.excludeFromScope(url);
      response.status(200);
      return "String_Node_Str";
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  get("String_Node_Str",(request,response) -> {
    IScanIssue[] rawIssues=callbacks.getScanIssues("String_Node_Str");
    List<BScanIssue> issues=new ArrayList<>();
    for (    IScanIssue issue : rawIssues) {
      issues.add(BScanIssueFactory.create(issue,callbacks));
    }
    return gson.toJson(new BArrayWrapper(issues));
  }
);
  get("String_Node_Str",(request,response) -> {
    byte[] encodedBytes=Base64.decodeBase64(request.params("String_Node_Str"));
    IScanIssue[] rawIssues=callbacks.getScanIssues(new String(encodedBytes));
    List<BScanIssue> issues=new ArrayList<>();
    for (    IScanIssue issue : rawIssues) {
      issues.add(BScanIssueFactory.create(issue,callbacks));
    }
    return gson.toJson(issues);
  }
);
  post("String_Node_Str",(request,response) -> {
    BScanIssue issue=gson.fromJson(request.body(),BScanIssue.class);
    callbacks.addScanIssue(issue);
    response.status(201);
    return gson.toJson(issue);
  }
);
  post("String_Node_Str",(request,response) -> {
    BURLMessage message=gson.fromJson(request.body(),BURLMessage.class);
    try {
      callbacks.sendToSpider(new URL(message.url));
      response.status(200);
      return "String_Node_Str";
    }
 catch (    MalformedURLException e) {
      response.status(400);
      return e.getMessage();
    }
  }
);
  get("String_Node_Str",(request,response) -> {
    List<BCookie> cookies=new ArrayList<>();
    for (    ICookie burpCookie : callbacks.getCookieJarContents()) {
      BCookie cookie=new BCookie();
      cookie.expiration=burpCookie.getExpiration();
      cookie.domain=burpCookie.getDomain();
      cookie.name=burpCookie.getName();
      cookie.value=burpCookie.getValue();
      cookies.add(cookie);
    }
    return gson.toJson(new BArrayWrapper(cookies));
  }
);
  post("String_Node_Str",(request,response) -> {
    BCookie cookie=gson.fromJson(request.body(),BCookie.class);
    callbacks.updateCookieJar(new ICookie(){
      @Override public String getDomain(){
        return cookie.domain;
      }
      @Override public Date getExpiration(){
        return cookie.expiration;
      }
      @Override public String getName(){
        return cookie.name;
      }
      @Override public String getValue(){
        return cookie.value;
      }
    }
);
    response.status(201);
    return gson.toJson(cookie);
  }
);
  post("String_Node_Str",(request,response) -> {
    BScanMessage message=gson.fromJson(request.body(),BScanMessage.class);
    IScanQueueItem item=callbacks.doActiveScan(message.host,message.port,message.useHttps,Base64.decodeBase64(message.request));
    BScanQueueID id=scanQueue.addToQueue(item);
    response.status(201);
    return gson.toJson(id);
  }
);
  get("String_Node_Str",(request,response) -> {
    int id=Integer.parseInt(request.params("String_Node_Str"));
    IScanQueueItem item=scanQueue.getItem(id);
    if (item == null) {
      response.status(404);
      return "String_Node_Str";
    }
    response.status(200);
    BScanQueueItem bScanQueueItem=BScanQueueItemFactory.create(id,item,callbacks);
    return gson.toJson(bScanQueueItem);
  }
);
  delete("String_Node_Str",(request,response) -> {
    int id=Integer.parseInt(request.params("String_Node_Str"));
    IScanQueueItem item=scanQueue.getItem(id);
    if (item == null) {
      response.status(404);
      return "String_Node_Str";
    }
    response.status(200);
    item.cancel();
    scanQueue.removeFromQueue(id);
    return "String_Node_Str";
  }
);
  post("String_Node_Str",(request,response) -> {
    BScanMessage message=gson.fromJson(request.body(),BScanMessage.class);
    callbacks.doPassiveScan(message.host,message.port,message.useHttps,Base64.decodeBase64(message.request),Base64.decodeBase64(message.response));
    response.status(201);
    return "String_Node_Str";
  }
);
  post("String_Node_Str",(request,response) -> {
    String tool=request.params("String_Node_Str");
    BScanMessage message=gson.fromJson(request.body(),BScanMessage.class);
switch (tool) {
case "String_Node_Str":
      callbacks.sendToIntruder(message.host,message.port,message.useHttps,Base64.decodeBase64(message.request));
    response.status(201);
  break;
case "String_Node_Str":
callbacks.sendToRepeater(message.host,message.port,message.useHttps,Base64.decodeBase64(message.request),"String_Node_Str");
response.status(201);
break;
default :
response.status(404);
break;
}
return "String_Node_Str";
}
);
post("String_Node_Str",(request,response) -> {
callbacks.issueAlert(gson.fromJson(request.body(),BMessage.class).message);
response.status(201);
return "String_Node_Str";
}
);
post("String_Node_Str",(request,response) -> {
stdout.println(gson.fromJson(request.body(),BMessage.class).message);
response.status(201);
return "String_Node_Str";
}
);
post("String_Node_Str",(request,response) -> {
stderr.println(gson.fromJson(request.body(),BMessage.class).message);
response.status(201);
return "String_Node_Str";
}
);
get("String_Node_Str",(request,response) -> {
List<BHttpRequestResponse> pairs=new ArrayList<>();
for (IHttpRequestResponse requestResponse : callbacks.getSiteMap("String_Node_Str")) {
pairs.add(BHttpRequestResponseFactory.create(requestResponse,callbacks,helpers));
}
return gson.toJson(new BArrayWrapper(pairs));
}
);
get("String_Node_Str",(request,response) -> {
byte[] encodedBytes=Base64.decodeBase64(request.params("String_Node_Str"));
List<BHttpRequestResponse> pairs=new ArrayList<>();
for (IHttpRequestResponse requestResponse : callbacks.getSiteMap(new String(encodedBytes))) {
pairs.add(BHttpRequestResponseFactory.create(requestResponse,callbacks,helpers));
}
return gson.toJson(new BArrayWrapper(pairs));
}
);
post("String_Node_Str",(request,response) -> {
BHttpRequestResponse bHttpRequestResponse=gson.fromJson(request.body(),BHttpRequestResponse.class);
callbacks.addToSiteMap(bHttpRequestResponse);
response.status(201);
return gson.toJson(bHttpRequestResponse);
}
);
get("String_Node_Str",(request,response) -> {
List<BHttpRequestResponse> pairs=new ArrayList<>();
for (IHttpRequestResponse requestResponse : callbacks.getProxyHistory()) {
pairs.add(BHttpRequestResponseFactory.create(requestResponse,callbacks,helpers));
}
return gson.toJson(new BArrayWrapper(pairs));
}
);
}