Program: 39950
Project: 39950
Buggy source:
@Override public Filter createFilter(FilterConfig filterConfig){
  Filter filter=new Filter(){
    public void init(    FilterConfig filterConfig) throws ServletException {
    }
    public void doFilter(    ServletRequest request,    ServletResponse response,    FilterChain chain) throws IOException, ServletException {
      HttpServletRequest r=(HttpServletRequest)request;
      String authorization=null;
      String userFromApiToken=null;
      if ((authorization=r.getHeader("String_Node_Str")) != null && authorization.toLowerCase().startsWith("String_Node_Str")) {
        String uidpassword=Scrambler.descramble(authorization.substring(6));
        int idx=uidpassword.indexOf(':');
        if (idx >= 0) {
          String username=uidpassword.substring(0,idx);
          String password=uidpassword.substring(idx + 1);
          User u=User.get(username,false);
          if (u != null) {
            ApiTokenProperty t=u.getProperty(ApiTokenProperty.class);
            if (t != null && t.matchesPassword(password)) {
              userFromApiToken=username;
            }
          }
        }
      }
      String userFromHeader=null;
      Authentication auth=Hudson.ANONYMOUS;
      if ((forwardedUser != null && (userFromHeader=r.getHeader(forwardedUser)) != null) || userFromApiToken != null) {
        LOGGER.log(Level.FINE,"String_Node_Str",userFromHeader);
        if (userFromHeader == null && userFromApiToken != null) {
          userFromHeader=userFromApiToken;
        }
        if (authContext == null) {
          authContext=new Hashtable<String,GrantedAuthority[]>();
        }
        if (getLDAPURL() != null) {
          GrantedAuthority[] storedGrants=authContext.get(userFromHeader);
          if (storedGrants != null && storedGrants.length > 1) {
            authorities=retrieveAuthoritiesIfNecessary(userFromHeader,storedGrants);
          }
 else {
            try {
              LdapUserDetails userDetails=(LdapUserDetails)loadUserByUsername(userFromHeader);
              authorities=userDetails.getAuthorities();
              Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>(Arrays.asList(authorities));
              tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
              authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
            }
 catch (            UsernameNotFoundException e) {
              LOGGER.log(Level.WARNING,"String_Node_Str" + e.getMessage());
              Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
              tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
              authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
            }
          }
        }
 else {
          String groups=r.getHeader(headerGroups);
          List<GrantedAuthority> localAuthorities=new ArrayList<GrantedAuthority>();
          localAuthorities.add(AUTHENTICATED_AUTHORITY);
          if (groups != null) {
            StringTokenizer tokenizer=new StringTokenizer(groups,headerGroupsDelimiter);
            while (tokenizer.hasMoreTokens()) {
              final String token=tokenizer.nextToken().trim();
              localAuthorities.add(new GrantedAuthorityImpl(token));
            }
          }
          authorities=localAuthorities.toArray(new GrantedAuthority[0]);
          SearchTemplate searchTemplate=new UserSearchTemplate(userFromHeader);
          Set<String> foundAuthorities=proxyTemplate.searchForSingleAttributeValues(searchTemplate,authorities);
          Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
          String[] authString=foundAuthorities.toArray(new String[0]);
          for (int i=0; i < authString.length; i++) {
            tempLocalAuthorities.add(new GrantedAuthorityImpl(authString[i]));
          }
          authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
          authContext.put(userFromHeader,authorities);
          auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
        }
        authContext.put(userFromHeader,authorities);
        auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
      }
      retrievedUser=userFromHeader;
      SecurityContextHolder.getContext().setAuthentication(auth);
      chain.doFilter(r,response);
    }
    public void destroy(){
    }
  }
;
  Filter defaultFilter=super.createFilter(filterConfig);
  return new ChainedServletFilter(filter,defaultFilter);
}

Fixed version (ground truth):
@Override public Filter createFilter(FilterConfig filterConfig){
  Filter filter=new Filter(){
    public void init(    FilterConfig filterConfig) throws ServletException {
    }
    public void doFilter(    ServletRequest request,    ServletResponse response,    FilterChain chain) throws IOException, ServletException {
      HttpServletRequest r=(HttpServletRequest)request;
      String authorization=null;
      String userFromApiToken=null;
      if ((authorization=r.getHeader("String_Node_Str")) != null && authorization.toLowerCase().startsWith("String_Node_Str")) {
        String uidpassword=Scrambler.descramble(authorization.substring(6));
        int idx=uidpassword.indexOf(':');
        if (idx >= 0) {
          String username=uidpassword.substring(0,idx);
          String password=uidpassword.substring(idx + 1);
          User u=User.get(username,false);
          if (u != null) {
            ApiTokenProperty t=u.getProperty(ApiTokenProperty.class);
            if (t != null && t.matchesPassword(password)) {
              userFromApiToken=username;
            }
          }
        }
      }
      String userFromHeader=null;
      Authentication auth=Jenkins.ANONYMOUS;
      if ((forwardedUser != null && (userFromHeader=r.getHeader(forwardedUser)) != null) || userFromApiToken != null) {
        LOGGER.log(Level.FINE,"String_Node_Str",userFromHeader);
        if (userFromHeader == null) {
          userFromHeader=userFromApiToken;
        }
        if (authContext == null) {
          authContext=new Hashtable<>();
        }
        if (getLDAPURL() != null) {
          GrantedAuthority[] storedGrants=authContext.get(userFromHeader);
          if (storedGrants != null && storedGrants.length > 1) {
            authorities=retrieveAuthoritiesIfNecessary(userFromHeader,storedGrants);
          }
 else {
            try {
              LdapUserDetails userDetails=(LdapUserDetails)loadUserByUsername(userFromHeader);
              authorities=userDetails.getAuthorities();
              Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>(Arrays.asList(authorities));
              tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
              authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
            }
 catch (            UsernameNotFoundException e) {
              LOGGER.log(Level.WARNING,"String_Node_Str" + e.getMessage());
              Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
              tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
              authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
            }
          }
        }
 else {
          String groups=r.getHeader(headerGroups);
          List<GrantedAuthority> localAuthorities=new ArrayList<GrantedAuthority>();
          localAuthorities.add(AUTHENTICATED_AUTHORITY);
          if (groups != null) {
            StringTokenizer tokenizer=new StringTokenizer(groups,headerGroupsDelimiter);
            while (tokenizer.hasMoreTokens()) {
              final String token=tokenizer.nextToken().trim();
              localAuthorities.add(new GrantedAuthorityImpl(token));
            }
          }
          authorities=localAuthorities.toArray(new GrantedAuthority[0]);
          SearchTemplate searchTemplate=new UserSearchTemplate(userFromHeader);
          Set<String> foundAuthorities=proxyTemplate.searchForSingleAttributeValues(searchTemplate,authorities);
          Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
          String[] authString=foundAuthorities.toArray(new String[0]);
          for (int i=0; i < authString.length; i++) {
            tempLocalAuthorities.add(new GrantedAuthorityImpl(authString[i]));
          }
          authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
          authContext.put(userFromHeader,authorities);
          auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
        }
        authContext.put(userFromHeader,authorities);
        auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
      }
      retrievedUser=userFromHeader;
      SecurityContextHolder.getContext().setAuthentication(auth);
      chain.doFilter(r,response);
    }
    public void destroy(){
    }
  }
;
  Filter defaultFilter=super.createFilter(filterConfig);
  return new ChainedServletFilter(filter,defaultFilter);
}