Program: 52003
Project: 52003
Buggy source:
protected void doDSGet(Context context,HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException, SQLException, AuthorizeException {
  String handle=null;
  String extraPathInfo=null;
  DSpaceObject dso=null;
  String path=request.getPathInfo();
  if (path != null) {
    path=path.substring(1);
    try {
      int firstSlash=path.indexOf('/');
      int secondSlash=path.indexOf('/',firstSlash + 1);
      if (secondSlash != -1) {
        handle=path.substring(0,secondSlash);
        extraPathInfo=path.substring(secondSlash);
      }
 else {
        handle=path;
      }
    }
 catch (    NumberFormatException nfe) {
    }
  }
  if (handle != null) {
    dso=HandleManager.resolveToObject(context,handle);
  }
  if (dso == null) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + path));
    JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
    return;
  }
  if ("String_Node_Str".equals(extraPathInfo)) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + handle + "String_Node_Str"+ extraPathInfo));
    request.setAttribute("String_Node_Str",handle);
    RequestDispatcher dispatch=getServletContext().getNamedDispatcher("String_Node_Str");
    dispatch.forward(request,response);
    return;
  }
  if (dso.getType() == Constants.ITEM) {
    if ((extraPathInfo == null) || (extraPathInfo.equals("String_Node_Str"))) {
      Item item=(Item)dso;
      if (context.getCurrentUser() == null) {
        response.setDateHeader("String_Node_Str",item.getLastModified().getTime());
        long modSince=request.getDateHeader("String_Node_Str");
        if (modSince != -1 && item.getLastModified().getTime() < modSince) {
          response.setStatus(HttpServletResponse.SC_NOT_MODIFIED);
        }
 else {
          displayItem(context,request,response,item,handle);
        }
      }
 else {
        displayItem(context,request,response,item,handle);
      }
    }
 else {
      request.getRequestDispatcher(extraPathInfo).forward(request,response);
    }
  }
 else   if (dso.getType() == Constants.COLLECTION) {
    Collection c=(Collection)dso;
    request.setAttribute("String_Node_Str",c);
    Community[] parents=c.getCommunities();
    request.setAttribute("String_Node_Str",parents[0]);
    request.setAttribute("String_Node_Str",getParents(parents[0],true));
    if ((extraPathInfo == null) || (extraPathInfo.equals("String_Node_Str"))) {
      collectionHome(context,request,response,parents[0],c);
    }
 else {
      request.getRequestDispatcher(extraPathInfo).forward(request,response);
    }
  }
 else   if (dso.getType() == Constants.COMMUNITY) {
    Community c=(Community)dso;
    request.setAttribute("String_Node_Str",c);
    request.setAttribute("String_Node_Str",getParents(c,false));
    if ((extraPathInfo == null) || (extraPathInfo.equals("String_Node_Str"))) {
      communityHome(context,request,response,c);
    }
 else {
      request.getRequestDispatcher(extraPathInfo).forward(request,response);
    }
  }
 else {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + handle));
    JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
    return;
  }
}

Fixed version (ground truth):
protected void doDSGet(Context context,HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException, SQLException, AuthorizeException {
  String handle=null;
  String extraPathInfo=null;
  DSpaceObject dso=null;
  String path=request.getPathInfo();
  if (path != null) {
    path=path.substring(1);
    try {
      int firstSlash=path.indexOf('/');
      int secondSlash=path.indexOf('/',firstSlash + 1);
      if (secondSlash != -1) {
        handle=path.substring(0,secondSlash);
        extraPathInfo=path.substring(secondSlash);
      }
 else {
        handle=path;
      }
    }
 catch (    NumberFormatException nfe) {
    }
  }
  if (handle != null) {
    dso=HandleManager.resolveToObject(context,handle);
  }
  if (dso == null) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + path));
    JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
    return;
  }
  if ("String_Node_Str".equals(extraPathInfo)) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + handle + "String_Node_Str"+ extraPathInfo));
    request.setAttribute("String_Node_Str",handle);
    RequestDispatcher dispatch=getServletContext().getNamedDispatcher("String_Node_Str");
    dispatch.forward(request,response);
    return;
  }
 else   if ("String_Node_Str".equals(extraPathInfo)) {
    request.getRequestDispatcher(extraPathInfo).forward(request,response);
    return;
  }
 else   if ("String_Node_Str".equals((extraPathInfo)) || StringUtils.startsWith(extraPathInfo,"String_Node_Str")) {
    request.getRequestDispatcher(extraPathInfo).forward(request,response);
    return;
  }
 else   if ("String_Node_Str".equals(extraPathInfo) || StringUtils.startsWith(extraPathInfo,"String_Node_Str")) {
    request.getRequestDispatcher(extraPathInfo).forward(request,response);
    return;
  }
  if (dso.getType() == Constants.ITEM) {
    if ((extraPathInfo == null) || (extraPathInfo.equals("String_Node_Str"))) {
      Item item=(Item)dso;
      if (context.getCurrentUser() == null) {
        response.setDateHeader("String_Node_Str",item.getLastModified().getTime());
        long modSince=request.getDateHeader("String_Node_Str");
        if (modSince != -1 && item.getLastModified().getTime() < modSince) {
          response.setStatus(HttpServletResponse.SC_NOT_MODIFIED);
        }
 else {
          displayItem(context,request,response,item,handle);
        }
      }
 else {
        displayItem(context,request,response,item,handle);
      }
    }
 else {
      log.debug("String_Node_Str");
      JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
      return;
    }
  }
 else   if (dso.getType() == Constants.COLLECTION) {
    Collection c=(Collection)dso;
    request.setAttribute("String_Node_Str",c);
    Community[] parents=c.getCommunities();
    request.setAttribute("String_Node_Str",parents[0]);
    request.setAttribute("String_Node_Str",getParents(parents[0],true));
    if ((extraPathInfo == null) || (extraPathInfo.equals("String_Node_Str"))) {
      collectionHome(context,request,response,parents[0],c);
    }
 else {
      log.debug("String_Node_Str");
      JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
      return;
    }
  }
 else   if (dso.getType() == Constants.COMMUNITY) {
    Community c=(Community)dso;
    request.setAttribute("String_Node_Str",c);
    request.setAttribute("String_Node_Str",getParents(c,false));
    if ((extraPathInfo == null) || (extraPathInfo.equals("String_Node_Str"))) {
      communityHome(context,request,response,c);
    }
 else {
      log.debug("String_Node_Str");
      JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
      return;
    }
  }
 else {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + handle));
    JSPManager.showInvalidIDError(request,response,StringEscapeUtils.escapeHtml(path),-1);
    return;
  }
}