Program: 39946
Project: 39946
Buggy source:
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  HttpServletRequest r=(HttpServletRequest)request;
  String authorization=null;
  String userFromApiToken=null;
  if ((authorization=r.getHeader("String_Node_Str")) != null && authorization.toLowerCase().startsWith("String_Node_Str")) {
    String uidpassword=Scrambler.descramble(authorization.substring(6));
    int idx=uidpassword.indexOf(':');
    if (idx >= 0) {
      String username=uidpassword.substring(0,idx);
      String password=uidpassword.substring(idx + 1);
      User u=User.get(username,false);
      if (u != null) {
        ApiTokenProperty t=u.getProperty(ApiTokenProperty.class);
        if (t != null && t.matchesPassword(password)) {
          userFromApiToken=username;
        }
      }
    }
  }
  String userFromHeader=null;
  Authentication auth=Hudson.ANONYMOUS;
  if ((forwardedUser != null && (userFromHeader=r.getHeader(forwardedUser)) != null) || userFromApiToken != null) {
    LOGGER.log(Level.FINE,"String_Node_Str",userFromHeader);
    if (userFromHeader == null && userFromApiToken != null) {
      userFromHeader=userFromApiToken;
    }
    if (authContext == null) {
      authContext=new Hashtable<String,GrantedAuthority[]>();
    }
    if (getLDAPURL() != null) {
      GrantedAuthority[] storedGrants=authContext.get(userFromHeader);
      if (storedGrants != null && storedGrants.length > 1) {
        authorities=retrieveAuthoritiesIfNecessary(userFromHeader,storedGrants);
      }
 else {
        try {
          LdapUserDetails userDetails=(LdapUserDetails)loadUserByUsername(userFromHeader);
          authorities=userDetails.getAuthorities();
          Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>(Arrays.asList(authorities));
          tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
          authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
        }
 catch (        UsernameNotFoundException e) {
          LOGGER.log(Level.WARNING,"String_Node_Str" + e.getMessage());
          Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
          tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
          authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
        }
      }
    }
 else {
      String groups=r.getHeader(headerGroups);
      List<GrantedAuthority> localAuthorities=new ArrayList<GrantedAuthority>();
      localAuthorities.add(AUTHENTICATED_AUTHORITY);
      if (groups != null) {
        StringTokenizer tokenizer=new StringTokenizer(groups,headerGroupsDelimiter);
        while (tokenizer.hasMoreTokens()) {
          final String token=tokenizer.nextToken().trim();
          localAuthorities.add(new GrantedAuthorityImpl(token));
        }
      }
      authorities=localAuthorities.toArray(new GrantedAuthority[0]);
      SearchTemplate searchTemplate=new UserSearchTemplate(userFromHeader);
      Set<String> foundAuthorities=proxyTemplate.searchForSingleAttributeValues(searchTemplate,authorities);
      Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
      String[] authString=foundAuthorities.toArray(new String[0]);
      for (int i=0; i < authString.length; i++) {
        tempLocalAuthorities.add(new GrantedAuthorityImpl(authString[i]));
      }
      authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
      authContext.put(userFromHeader,authorities);
      auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
    }
    authContext.put(userFromHeader,authorities);
    auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
  }
  retrievedUser=userFromHeader;
  SecurityContextHolder.getContext().setAuthentication(auth);
  chain.doFilter(r,response);
}

Fixed version (ground truth):
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  HttpServletRequest r=(HttpServletRequest)request;
  String authorization=null;
  String userFromApiToken=null;
  if ((authorization=r.getHeader("String_Node_Str")) != null && authorization.toLowerCase().startsWith("String_Node_Str")) {
    String uidpassword=Scrambler.descramble(authorization.substring(6));
    int idx=uidpassword.indexOf(':');
    if (idx >= 0) {
      String username=uidpassword.substring(0,idx);
      String password=uidpassword.substring(idx + 1);
      User u=User.get(username,false);
      if (u != null) {
        ApiTokenProperty t=u.getProperty(ApiTokenProperty.class);
        if (t != null && t.matchesPassword(password)) {
          userFromApiToken=username;
        }
      }
    }
  }
  String userFromHeader=null;
  Authentication auth=Jenkins.ANONYMOUS;
  if ((forwardedUser != null && (userFromHeader=r.getHeader(forwardedUser)) != null) || userFromApiToken != null) {
    LOGGER.log(Level.FINE,"String_Node_Str",userFromHeader);
    if (userFromHeader == null) {
      userFromHeader=userFromApiToken;
    }
    if (authContext == null) {
      authContext=new Hashtable<>();
    }
    if (getLDAPURL() != null) {
      GrantedAuthority[] storedGrants=authContext.get(userFromHeader);
      if (storedGrants != null && storedGrants.length > 1) {
        authorities=retrieveAuthoritiesIfNecessary(userFromHeader,storedGrants);
      }
 else {
        try {
          LdapUserDetails userDetails=(LdapUserDetails)loadUserByUsername(userFromHeader);
          authorities=userDetails.getAuthorities();
          Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>(Arrays.asList(authorities));
          tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
          authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
        }
 catch (        UsernameNotFoundException e) {
          LOGGER.log(Level.WARNING,"String_Node_Str" + e.getMessage());
          Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
          tempLocalAuthorities.add(AUTHENTICATED_AUTHORITY);
          authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
        }
      }
    }
 else {
      String groups=r.getHeader(headerGroups);
      List<GrantedAuthority> localAuthorities=new ArrayList<GrantedAuthority>();
      localAuthorities.add(AUTHENTICATED_AUTHORITY);
      if (groups != null) {
        StringTokenizer tokenizer=new StringTokenizer(groups,headerGroupsDelimiter);
        while (tokenizer.hasMoreTokens()) {
          final String token=tokenizer.nextToken().trim();
          localAuthorities.add(new GrantedAuthorityImpl(token));
        }
      }
      authorities=localAuthorities.toArray(new GrantedAuthority[0]);
      SearchTemplate searchTemplate=new UserSearchTemplate(userFromHeader);
      Set<String> foundAuthorities=proxyTemplate.searchForSingleAttributeValues(searchTemplate,authorities);
      Set<GrantedAuthority> tempLocalAuthorities=new HashSet<GrantedAuthority>();
      String[] authString=foundAuthorities.toArray(new String[0]);
      for (int i=0; i < authString.length; i++) {
        tempLocalAuthorities.add(new GrantedAuthorityImpl(authString[i]));
      }
      authorities=tempLocalAuthorities.toArray(new GrantedAuthority[0]);
      authContext.put(userFromHeader,authorities);
      auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
    }
    authContext.put(userFromHeader,authorities);
    auth=new UsernamePasswordAuthenticationToken(userFromHeader,"String_Node_Str",authorities);
  }
  retrievedUser=userFromHeader;
  SecurityContextHolder.getContext().setAuthentication(auth);
  chain.doFilter(r,response);
}