Program: 63079
Project: 63079
Buggy source:
/** 
 * V3.x版本native回调<br> &ltxml&gt</br> &ltopenid&gt&lt![CDATA[111222]]&gt&lt/openid&gt</br> &ltappid&gt&lt![CDATA[wwwwb4f85f3a797777]]&gt&lt/appid&gt</br> &ltmch_id&gt&lt![CDATA[1100022]]&gt&lt/mch_id&gt</br> &ltis_subscribe&gt1&lt/is_subscribe&gt</br> &ltproduct_id&gt[CDATA[000000]]&lt/product_id&gt</br> &ltnonce_str&gt&lt![CDATA[jALldRTHAFd5Tgs5]]&gt&lt/nonce_str&gt</br> &ltsign>&lt![CDATA[bafe07f060f22dcda0bfdb4b5ff756f973aecffa]]&gt&lt/sign& gt</br> &lt/xml&gt</br>
 * @return
 * @throws PayException
 */
public String nativeNotifyV3(InputStream inputStream) throws PayException {
  NativePayNotifyV3 payNotify=XStream.get(inputStream,NativePayNotifyV3.class);
  String sign=payNotify.getSign();
  payNotify.setSign(null);
  WeixinMpAccount weixinAccount=ConfigUtil.getWeixinMpAccount();
  String valid_sign=PayUtil.paysignMd5(payNotify,weixinAccount.getPaySignKey());
  log.info("String_Node_Str",sign,valid_sign);
  PayPackageV3 payPackage=new PayPackageV3(weixinAccount,"String_Node_Str","String_Node_Str","String_Node_Str",1d,"String_Node_Str",TradeType.NATIVE);
  payPackage.setProduct_id(payNotify.getProductId());
  if (!sign.equals(valid_sign)) {
    NativePayResponseV3 payReponse=new NativePayResponseV3(payPackage,"String_Node_Str",null);
    payReponse.setSign(PayUtil.paysignMd5(payReponse,weixinAccount.getPaySignKey()));
    return XStream.to(payReponse);
  }
  NativePayResponseV3 payReponse=new NativePayResponseV3(payPackage,null,null);
  payReponse.setSign(PayUtil.paysignMd5(payReponse,weixinAccount.getPaySignKey()));
  return XStream.to(payReponse);
}

Fixed version (ground truth):
/** 
 * V3.x版本native回调<br> &ltxml&gt</br> &ltopenid&gt&lt![CDATA[111222]]&gt&lt/openid&gt</br> &ltappid&gt&lt![CDATA[wwwwb4f85f3a797777]]&gt&lt/appid&gt</br> &ltmch_id&gt&lt![CDATA[1100022]]&gt&lt/mch_id&gt</br> &ltis_subscribe&gt1&lt/is_subscribe&gt</br> &ltproduct_id&gt[CDATA[000000]]&lt/product_id&gt</br> &ltnonce_str&gt&lt![CDATA[jALldRTHAFd5Tgs5]]&gt&lt/nonce_str&gt</br> &ltsign>&lt![CDATA[bafe07f060f22dcda0bfdb4b5ff756f973aecffa]]&gt &lt/sign&gt</br> &lt/xml&gt</br>
 * @return
 * @throws PayException
 */
public String nativeNotifyV3(InputStream inputStream) throws PayException {
  NativePayNotifyV3 payNotify=XStream.get(inputStream,NativePayNotifyV3.class);
  String sign=payNotify.getSign();
  payNotify.setSign(null);
  WeixinMpAccount weixinAccount=ConfigUtil.getWeixinMpAccount();
  String valid_sign=PayUtil.paysignMd5(payNotify,weixinAccount.getPaySignKey());
  log.info("String_Node_Str",sign,valid_sign);
  PayPackageV3 payPackage=new PayPackageV3(weixinAccount,"String_Node_Str","String_Node_Str","String_Node_Str",1d,"String_Node_Str",TradeType.NATIVE);
  payPackage.setProduct_id(payNotify.getProductId());
  if (!sign.equals(valid_sign)) {
    NativePayResponseV3 payReponse=new NativePayResponseV3(payPackage,"String_Node_Str",null);
    payReponse.setSign(PayUtil.paysignMd5(payReponse,weixinAccount.getPaySignKey()));
    return XStream.to(payReponse);
  }
  NativePayResponseV3 payReponse=new NativePayResponseV3(payPackage,null,null);
  payReponse.setSign(PayUtil.paysignMd5(payReponse,weixinAccount.getPaySignKey()));
  return XStream.to(payReponse);
}