Program: 37262
Project: 37262
Buggy source:
/** 
 * <pre> search nameserver by name or ip. URI:/nameservers?name={nsName}  OR /nameservers?ip={ip}  parameter 'ip' can only be precise ip address.  This service is under permission control, @see AccessControlManager. This service is under policy control, @see PolicyControlService. </pre>
 * @param name is a fully-qualified (relative to the root) domain name [RFC1594] in either the in-addr.arpa or ip6.arpa zones (for RIRs) or a fully-qualified domain name in a zone administered by the server operator (for DNRs).
 * @param request HttpServletRequest
 * @param response HttpServletResponse
 * @return JSON formated result,with HTTP code.
 */
@RequestMapping(value="String_Node_Str",method=RequestMethod.GET) @ResponseBody public ResponseEntity searchNameserver(@RequestParam(required=false) String name,HttpServletRequest request,HttpServletResponse response) throws DecodeException {
  String lastSpliInURI=queryParser.getLastSplitInURI(request);
  if (!"String_Node_Str".equals(lastSpliInURI)) {
    return RestResponseUtil.createResponse400();
  }
  final String strIp="String_Node_Str";
  final String strName="String_Node_Str";
  NameserverQueryParam nsQueryParam=null;
  final String[] strParamOrg={strIp,strName};
  String nameParam=queryParser.getFirstParameter(request,strParamOrg);
  if (StringUtils.isBlank(nameParam)) {
    return RestResponseUtil.createResponse400();
  }
  if (0 == nameParam.compareTo(strIp)) {
    name=queryParser.getParameter(request,strIp);
    if (StringUtils.isBlank(name) || !IpUtil.isIpV4StrWholeValid(name) && !IpUtil.isIpV6StrValid(name)) {
      return RestResponseUtil.createResponse400();
    }
    name=StringUtils.lowerCase(name);
    nsQueryParam=(NameserverQueryParam)queryParser.parseNameserverQueryParam(name,name);
    nsQueryParam.setIsSearchByIp(true);
  }
 else   if (0 == nameParam.compareTo(strName)) {
    name=queryParser.getParameter(request,strName);
    String decodeNameserver=name;
    try {
      decodeNameserver=DomainUtil.iso8859Decode(name);
      decodeNameserver=DomainUtil.urlDecode(decodeNameserver);
    }
 catch (    Exception e) {
      return RestResponseUtil.createResponse400();
    }
    if (StringUtils.isBlank(decodeNameserver)) {
      return RestResponseUtil.createResponse400();
    }
    if (!StringUtil.checkIsValidSearchPattern(decodeNameserver)) {
      return RestResponseUtil.createResponse422();
    }
    if (!DomainUtil.validateSearchStringIsValidIdna(decodeNameserver)) {
      return RestResponseUtil.createResponse400();
    }
    decodeNameserver=StringUtil.foldCaseAndNormalization(decodeNameserver);
    decodeNameserver=DomainUtil.deleteLastPoint(decodeNameserver);
    nsQueryParam=(NameserverQueryParam)queryParser.parseNameserverQueryParam(decodeNameserver,decodeNameserver);
    nsQueryParam.setIsSearchByIp(false);
  }
 else {
    return RestResponseUtil.createResponse400();
  }
  NameserverSearch nsSearch=searchService.searchNameserver(nsQueryParam);
  if (null != nsSearch) {
    if (nsSearch.getHasNoAuthForAllObjects()) {
      return RestResponseUtil.createResponse403();
    }
    responseDecorator.decorateResponse(nsSearch);
    return RestResponseUtil.createResponse200(nsSearch);
  }
  return RestResponseUtil.createResponse404();
}

Fixed version (ground truth):
/** 
 * <pre> search nameserver by name or ip. URI:/nameservers?name={nsName}  OR /nameservers?ip={ip}  parameter 'ip' can only be precise ip address.  This service is under permission control, @see AccessControlManager. This service is under policy control, @see PolicyControlService. </pre>
 * @param name is a fully-qualified (relative to the root) domain name [RFC1594] in either the in-addr.arpa or ip6.arpa zones (for RIRs) or a fully-qualified domain name in a zone administered by the server operator (for DNRs).
 * @param request HttpServletRequest
 * @param response HttpServletResponse
 * @return JSON formated result,with HTTP code.
 * @throws DecodeException DecodeException.
 */
@RequestMapping(value="String_Node_Str",method=RequestMethod.GET) @ResponseBody public ResponseEntity searchNameserver(@RequestParam(required=false) String name,HttpServletRequest request,HttpServletResponse response) throws DecodeException {
  String lastSpliInURI=queryParser.getLastSplitInURI(request);
  if (!"String_Node_Str".equals(lastSpliInURI)) {
    return RestResponseUtil.createResponse400();
  }
  final String strIp="String_Node_Str";
  final String strName="String_Node_Str";
  NameserverQueryParam nsQueryParam=null;
  final String[] strParamOrg={strIp,strName};
  String nameParam=queryParser.getFirstParameter(request,strParamOrg);
  if (StringUtils.isBlank(nameParam)) {
    return RestResponseUtil.createResponse400();
  }
  if (0 == nameParam.compareTo(strIp)) {
    name=queryParser.getParameter(request,strIp);
    if (StringUtils.isBlank(name) || !IpUtil.isIpV4StrWholeValid(name) && !IpUtil.isIpV6StrValid(name)) {
      return RestResponseUtil.createResponse400();
    }
    name=StringUtils.lowerCase(name);
    nsQueryParam=(NameserverQueryParam)queryParser.parseNameserverQueryParam(name,name);
    nsQueryParam.setIsSearchByIp(true);
  }
 else   if (0 == nameParam.compareTo(strName)) {
    name=queryParser.getParameter(request,strName);
    String decodeNameserver=name;
    try {
      decodeNameserver=DomainUtil.iso8859Decode(name);
      decodeNameserver=DomainUtil.urlDecode(decodeNameserver);
    }
 catch (    Exception e) {
      return RestResponseUtil.createResponse400();
    }
    if (StringUtils.isBlank(decodeNameserver)) {
      return RestResponseUtil.createResponse400();
    }
    if (!StringUtil.checkIsValidSearchPattern(decodeNameserver)) {
      return RestResponseUtil.createResponse422();
    }
    if (!DomainUtil.validateSearchStringIsValidIdna(decodeNameserver)) {
      return RestResponseUtil.createResponse400();
    }
    decodeNameserver=StringUtil.foldCaseAndNormalization(decodeNameserver);
    decodeNameserver=DomainUtil.deleteLastPoint(decodeNameserver);
    nsQueryParam=(NameserverQueryParam)queryParser.parseNameserverQueryParam(decodeNameserver,decodeNameserver);
    nsQueryParam.setIsSearchByIp(false);
  }
 else {
    return RestResponseUtil.createResponse400();
  }
  NameserverSearch nsSearch=searchService.searchNameserver(nsQueryParam);
  if (null != nsSearch) {
    if (nsSearch.getHasNoAuthForAllObjects()) {
      return RestResponseUtil.createResponse403();
    }
    responseDecorator.decorateResponse(nsSearch);
    return RestResponseUtil.createResponse200(nsSearch);
  }
  return RestResponseUtil.createResponse404();
}