nus-yam/ex-repair huggingface dataset:
Program: 31351
Project: 31351
Buggy source:
/** 
 * Returns the enumeration of header names from the HttpServletRequest after canonicalizing and filtering out any dangerous characters.
 * @return An {@code Enumeration} of header names associated with this request.
 */
public Enumeration getHeaderNames(){
  Vector<String> v=new Vector<String>();
  Enumeration en=getHttpServletRequest().getHeaderNames();
  while (en.hasMoreElements()) {
    try {
      String name=(String)en.nextElement();
      String clean=ESAPI.validator().getValidInput("String_Node_Str" + name,name,"String_Node_Str",150,false);
      v.add(clean);
    }
 catch (    ValidationException e) {
    }
  }
  return v.elements();
}

Fixed version (ground truth):
/** 
 * Returns the enumeration of header names from the HttpServletRequest after canonicalizing and filtering out any dangerous characters.
 * @return An {@code Enumeration} of header names associated with this request.
 */
public Enumeration getHeaderNames(){
  Vector<String> v=new Vector<String>();
  Enumeration en=getHttpServletRequest().getHeaderNames();
  while (en.hasMoreElements()) {
    try {
      String name=(String)en.nextElement();
      String clean=ESAPI.validator().getValidInput("String_Node_Str" + name,name,"String_Node_Str",150,true);
      v.add(clean);
    }
 catch (    ValidationException e) {
    }
  }
  return v.elements();
}
Program: 31352
Project: 31352
Buggy source:
/** 
 * Utility method to get a resource as an InputStream. The search looks for an "esapi-resources" directory in the setResourceDirectory() location, then the System.getProperty( "org.owasp.esapi.resources" ) location, then the System.getProperty( "user.home" ) location, and then the classpath.
 * @param filename
 * @return	An {@code InputStream} associated with the specified file name as a resourcestream.
 * @throws IOException	If the file cannot be found or opened for reading.
 */
public InputStream getResourceStream(String filename) throws IOException {
  try {
    File f=getResourceFile(filename);
    if (f != null && f.exists()) {
      return new FileInputStream(f);
    }
  }
 catch (  Exception e) {
  }
  ClassLoader loader=getClass().getClassLoader();
  InputStream in=loader.getResourceAsStream("String_Node_Str" + filename);
  if (in != null) {
    logSpecial("String_Node_Str",null);
    return in;
  }
 else {
    logSpecial("String_Node_Str",null);
    logSpecial("String_Node_Str",null);
  }
  return null;
}

Fixed version (ground truth):
/** 
 * Utility method to get a resource as an InputStream. The search looks for an "esapi-resources" directory in the setResourceDirectory() location, then the System.getProperty( "org.owasp.esapi.resources" ) location, then the System.getProperty( "user.home" ) location, and then the classpath.
 * @param filename
 * @return	An {@code InputStream} associated with the specified file name as a resourcestream.
 * @throws IOException	If the file cannot be found or opened for reading.
 */
public InputStream getResourceStream(String filename) throws IOException {
  if (filename == null) {
    System.out.println("String_Node_Str");
    return null;
  }
  try {
    File f=getResourceFile(filename);
    if (f != null && f.exists()) {
      return new FileInputStream(f);
    }
  }
 catch (  Exception e) {
  }
  ClassLoader loader=getClass().getClassLoader();
  System.out.println("String_Node_Str" + loader);
  String filePathToLoad="String_Node_Str" + filename;
  System.out.println("String_Node_Str" + filePathToLoad);
  URL resourceURL=loader.getResource(filePathToLoad);
  System.out.println("String_Node_Str" + resourceURL);
  String resource=resourceURL.getFile();
  System.out.println("String_Node_Str" + resource);
  resource.replace("String_Node_Str","String_Node_Str");
  FileInputStream in=new FileInputStream(new File(resource));
  if (in != null) {
    logSpecial("String_Node_Str",null);
    return in;
  }
 else {
    logSpecial("String_Node_Str",null);
    logSpecial("String_Node_Str",null);
  }
  return null;
}
Program: 31353
Project: 31353
Buggy source:
/** 
 * Utility method to get a resource as an InputStream. The search looks for an "esapi-resources" directory in the setResourceDirectory() location, then the System.getProperty( "org.owasp.esapi.resources" ) location, then the System.getProperty( "user.home" ) location, and then the classpath.
 * @param filename
 * @return	An {@code InputStream} associated with the specified file name as a resourcestream.
 * @throws IOException	If the file cannot be found or opened for reading.
 */
public InputStream getResourceStream(String filename) throws IOException {
  try {
    File f=getResourceFile(filename);
    if (f != null && f.exists()) {
      return new FileInputStream(f);
    }
  }
 catch (  Exception e) {
  }
  ClassLoader loader=getClass().getClassLoader();
  InputStream in=loader.getResourceAsStream("String_Node_Str" + filename);
  if (in != null) {
    logSpecial("String_Node_Str",null);
    return in;
  }
 else {
    logSpecial("String_Node_Str",null);
    logSpecial("String_Node_Str",null);
  }
  return null;
}

Fixed version (ground truth):
/** 
 * Utility method to get a resource as an InputStream. The search looks for an "esapi-resources" directory in the setResourceDirectory() location, then the System.getProperty( "org.owasp.esapi.resources" ) location, then the System.getProperty( "user.home" ) location, and then the classpath.
 * @param filename
 * @return	An {@code InputStream} associated with the specified file name as a resourcestream.
 * @throws IOException	If the file cannot be found or opened for reading.
 */
public InputStream getResourceStream(String filename) throws IOException {
  if (filename == null) {
    System.out.println("String_Node_Str");
    return null;
  }
  try {
    File f=getResourceFile(filename);
    if (f != null && f.exists()) {
      return new FileInputStream(f);
    }
  }
 catch (  Exception e) {
  }
  ClassLoader loader=getClass().getClassLoader();
  System.out.println("String_Node_Str" + loader);
  String filePathToLoad="String_Node_Str" + filename;
  System.out.println("String_Node_Str" + filePathToLoad);
  URL resourceURL=loader.getResource(filePathToLoad);
  System.out.println("String_Node_Str" + resourceURL);
  String resource=resourceURL.getFile();
  System.out.println("String_Node_Str" + resource);
  resource=resource.replace("String_Node_Str","String_Node_Str");
  FileInputStream in=new FileInputStream(new File(resource));
  if (in != null) {
    logSpecial("String_Node_Str",null);
    return in;
  }
 else {
    logSpecial("String_Node_Str",null);
    logSpecial("String_Node_Str",null);
  }
  return null;
}
Program: 31354
Project: 31354
Buggy source:
/** 
 * {@inheritDoc}
 */
public String getValid(String context,String input) throws ValidationException {
  if (StringUtils.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=ccrule.getValid(context,input);
  if (!validCreditCardFormat(canonical)) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context,context);
  }
  return canonical;
}

Fixed version (ground truth):
/** 
 * {@inheritDoc}
 */
public String getValid(String context,String input) throws ValidationException {
  if (StringUtilities.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=ccrule.getValid(context,input);
  if (!validCreditCardFormat(canonical)) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context,context);
  }
  return canonical;
}
Program: 31355
Project: 31355
Buggy source:
private Date safelyParse(String context,String input) throws ValidationException {
  if (StringUtils.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=null;
  try {
    canonical=encoder.canonicalize(input);
  }
 catch (  EncodingException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str",e,context);
  }
  try {
    return format.parse(canonical);
  }
 catch (  Exception e) {
    throw new ValidationException(context + "String_Node_Str" + format.getNumberFormat()+ "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ format+ "String_Node_Str"+ input,e,context);
  }
}

Fixed version (ground truth):
private Date safelyParse(String context,String input) throws ValidationException {
  if (StringUtilities.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=null;
  try {
    canonical=encoder.canonicalize(input);
  }
 catch (  EncodingException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str",e,context);
  }
  try {
    return format.parse(canonical);
  }
 catch (  Exception e) {
    throw new ValidationException(context + "String_Node_Str" + format.getNumberFormat()+ "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ format+ "String_Node_Str"+ input,e,context);
  }
}
Program: 31356
Project: 31356
Buggy source:
private String invokeAntiSamy(String context,String input) throws ValidationException {
  if (StringUtils.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=super.getValid(context,input);
  try {
    AntiSamy as=new AntiSamy();
    CleanResults test=as.scan(canonical,antiSamyPolicy);
    List<String> errors=test.getErrorMessages();
    if (!errors.isEmpty()) {
      LOGGER.info(Logger.SECURITY_FAILURE,"String_Node_Str" + errors);
    }
    return test.getCleanHTML().trim();
  }
 catch (  ScanException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ e.getMessage(),e,context);
  }
catch (  PolicyException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ e.getMessage(),e,context);
  }
}

Fixed version (ground truth):
private String invokeAntiSamy(String context,String input) throws ValidationException {
  if (StringUtilities.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=super.getValid(context,input);
  try {
    AntiSamy as=new AntiSamy();
    CleanResults test=as.scan(canonical,antiSamyPolicy);
    List<String> errors=test.getErrorMessages();
    if (!errors.isEmpty()) {
      LOGGER.info(Logger.SECURITY_FAILURE,"String_Node_Str" + errors);
    }
    return test.getCleanHTML().trim();
  }
 catch (  ScanException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ e.getMessage(),e,context);
  }
catch (  PolicyException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ e.getMessage(),e,context);
  }
}
Program: 31357
Project: 31357
Buggy source:
private Integer safelyParse(String context,String input) throws ValidationException {
  if (StringUtils.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=null;
  try {
    canonical=encoder.canonicalize(input);
  }
 catch (  EncodingException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str",e,context);
  }
  if (minValue > maxValue) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + maxValue + "String_Node_Str"+ minValue+ "String_Node_Str"+ context,context);
  }
  try {
    int i=Integer.valueOf(canonical);
    if (i < minValue) {
      throw new ValidationException("String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context,"String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context+ "String_Node_Str"+ input,context);
    }
    if (i > maxValue) {
      throw new ValidationException("String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context,"String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context+ "String_Node_Str"+ input,context);
    }
    return i;
  }
 catch (  NumberFormatException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,e,context);
  }
}

Fixed version (ground truth):
private Integer safelyParse(String context,String input) throws ValidationException {
  if (StringUtilities.isEmpty(input)) {
    if (allowNull) {
      return null;
    }
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,context);
  }
  String canonical=null;
  try {
    canonical=encoder.canonicalize(input);
  }
 catch (  EncodingException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str",e,context);
  }
  if (minValue > maxValue) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + maxValue + "String_Node_Str"+ minValue+ "String_Node_Str"+ context,context);
  }
  try {
    int i=Integer.valueOf(canonical);
    if (i < minValue) {
      throw new ValidationException("String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context,"String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context+ "String_Node_Str"+ input,context);
    }
    if (i > maxValue) {
      throw new ValidationException("String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context,"String_Node_Str" + minValue + "String_Node_Str"+ maxValue+ "String_Node_Str"+ context+ "String_Node_Str"+ input,context);
    }
    return i;
  }
 catch (  NumberFormatException e) {
    throw new ValidationException(context + "String_Node_Str","String_Node_Str" + context + "String_Node_Str"+ input,e,context);
  }
}
Program: 31359
Project: 31359
Buggy source:
/** 
 * {@inheritDoc}This implementation uses a custom "set-cookie" header rather than Java's cookie interface which doesn't allow the use of HttpOnly. Configure the HttpOnly and Secure settings in ESAPI.properties.
 */
public void addCookie(HttpServletResponse response,Cookie cookie){
  String name=cookie.getName();
  String value=cookie.getValue();
  int maxAge=cookie.getMaxAge();
  String domain=cookie.getDomain();
  String path=cookie.getPath();
  boolean secure=cookie.getSecure();
  ValidationErrorList errors=new ValidationErrorList();
  String cookieName=ESAPI.validator().getValidInput("String_Node_Str",name,"String_Node_Str",50,false,errors);
  String cookieValue=ESAPI.validator().getValidInput("String_Node_Str",value,"String_Node_Str",5000,false,errors);
  if (errors.size() == 0) {
    if (ESAPI.securityConfiguration().getForceHttpOnlyCookies()) {
      String header=createCookieHeader(cookieName,cookieValue,maxAge,domain,path,secure);
      addHeader(response,"String_Node_Str",header);
    }
 else {
      response.addCookie(cookie);
    }
    return;
  }
  logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str");
}

Fixed version (ground truth):
/** 
 * {@inheritDoc}This implementation uses a custom "set-cookie" header rather than Java's cookie interface which doesn't allow the use of HttpOnly. Configure the HttpOnly and Secure settings in ESAPI.properties.
 */
public void addCookie(HttpServletResponse response,Cookie cookie){
  String name=cookie.getName();
  String value=cookie.getValue();
  int maxAge=cookie.getMaxAge();
  String domain=cookie.getDomain();
  String path=cookie.getPath();
  boolean secure=cookie.getSecure();
  ValidationErrorList errors=new ValidationErrorList();
  String cookieName=ESAPI.validator().getValidInput("String_Node_Str",name,"String_Node_Str",50,false,errors);
  String cookieValue=ESAPI.validator().getValidInput("String_Node_Str",value,"String_Node_Str",5000,false,errors);
  if (errors.size() == 0) {
    if (ESAPI.securityConfiguration().getForceHttpOnlyCookies()) {
      String header=createCookieHeader(cookieName,cookieValue,maxAge,domain,path,secure);
      addHeader(response,"String_Node_Str",header);
    }
 else {
      cookie.setSecure(secure || ESAPI.securityConfiguration().getForceSecureCookies());
      response.addCookie(cookie);
    }
    return;
  }
  logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str");
}
Program: 31361
Project: 31361
Buggy source:
public void testBadUserAgent() throws Exception {
  request.addHeader("String_Node_Str","String_Node_Str");
  WAFTestUtility.createAndExecuteWAFTransaction("String_Node_Str",request,response);
  assert(response.getStatus() == HttpServletResponse.SC_MOVED_PERMANENTLY);
}

Fixed version (ground truth):
public void testBadUserAgent() throws Exception {
  request.addHeader("String_Node_Str","String_Node_Str");
  WAFTestUtility.createAndExecuteWAFTransaction("String_Node_Str",request,response);
  assert(response.getStatus() == 403);
}
Program: 31362
Project: 31362
Buggy source:
/** 
 * Change the current ESAPI SecurityConfiguration to the SecurityConfiguration provided.  CHECKME: Why not return the previous value here? Also, doesn't it make sense to check for null in all setters?
 * @param securityConfiguration the SecurityConfiguration to set to be the current ESAPI SecurityConfiguration. 
 */
public static void setSecurityConfiguration(SecurityConfiguration securityConfiguration){
  if (securityConfiguration != null) {
    ESAPI.securityConfiguration=securityConfiguration;
  }
 else {
    System.out.println("String_Node_Str");
  }
}

Fixed version (ground truth):
/** 
 * Change the current ESAPI SecurityConfiguration to the SecurityConfiguration provided.  CHECKME: Why not return the previous value here? Also, doesn't it make sense to check for null in all setters?
 * @param securityConfiguration the SecurityConfiguration to set to be the current ESAPI SecurityConfiguration. 
 */
public static void setSecurityConfiguration(SecurityConfiguration securityConfiguration){
  if (securityConfiguration != null) {
    ESAPI.securityConfiguration=securityConfiguration;
  }
 else {
    throw new NullPointerException("String_Node_Str");
  }
}
Program: 31363
Project: 31363
Buggy source:
/** 
 * {@inheritDoc}
 */
public synchronized void removeUser(String accountName) throws AuthenticationException {
  loadUsersIfNecessary();
  User user=getUser(accountName);
  if (user == null) {
    throw new AuthenticationAccountsException("String_Node_Str","String_Node_Str" + accountName);
  }
  userMap.remove(user.getAccountId());
  System.out.println("String_Node_Str" + user.getAccountName());
  passwordMap.remove(user);
  saveUsers();
}

Fixed version (ground truth):
/** 
 * {@inheritDoc}
 */
public synchronized void removeUser(String accountName) throws AuthenticationException {
  loadUsersIfNecessary();
  User user=getUser(accountName);
  if (user == null) {
    throw new AuthenticationAccountsException("String_Node_Str","String_Node_Str" + accountName);
  }
  userMap.remove(user.getAccountId());
  logger.info(Logger.SECURITY_SUCCESS,"String_Node_Str" + user.getAccountName());
  passwordMap.remove(user);
  saveUsers();
}
Program: 31365
Project: 31365
Buggy source:
public Action check(HttpServletRequest request,InterceptingHTTPServletResponse response,HttpServletResponse httpResponse){
  if (path != null && !path.matcher(request.getRequestURI()).matches()) {
    return new DoNothingAction();
  }
  try {
    Action a=null;
    i.set("String_Node_Str",a);
    i.set("String_Node_Str",request);
    if (response != null) {
      i.set("String_Node_Str",response);
    }
 else {
      i.set("String_Node_Str",httpResponse);
    }
    i.set("String_Node_Str",request.getSession());
    i.eval(script);
    a=(Action)i.get("String_Node_Str");
    if (a != null) {
      return a;
    }
  }
 catch (  EvalError e) {
    log(request,"String_Node_Str" + id + "String_Node_Str"+ e.getMessage());
    e.printStackTrace();
    System.out.println(e.getScriptStackTrace());
  }
  return new DoNothingAction();
}

Fixed version (ground truth):
public Action check(HttpServletRequest request,InterceptingHTTPServletResponse response,HttpServletResponse httpResponse){
  if (path != null && !path.matcher(request.getRequestURI()).matches()) {
    return new DoNothingAction();
  }
  try {
    Action a=null;
    i.set("String_Node_Str",a);
    i.set("String_Node_Str",request);
    if (response != null) {
      i.set("String_Node_Str",response);
    }
 else {
      i.set("String_Node_Str",httpResponse);
    }
    i.set("String_Node_Str",request.getSession());
    i.eval(script);
    a=(Action)i.get("String_Node_Str");
    if (a != null) {
      return a;
    }
  }
 catch (  EvalError e) {
    log(request,"String_Node_Str" + id + "String_Node_Str"+ e.getMessage());
  }
  return new DoNothingAction();
}
Program: 31366
Project: 31366
Buggy source:
/** 
 * @param filterConfig
 * @throws javax.servlet.ServletException
 */
public void init(FilterConfig filterConfig) throws ServletException {
}

Fixed version (ground truth):
/** 
 * @param filterConfig
 * @throws javax.servlet.ServletException
 */
public void init(FilterConfig filterConfig) throws ServletException {
  this.allowableResourcesRoot=StringUtilities.replaceNull(filterConfig.getInitParameter("String_Node_Str"),allowableResourcesRoot);
}
Program: 31367
Project: 31367
Buggy source:
/** 
 * @param request
 * @param response
 * @param chain
 * @throws java.io.IOException
 * @throws javax.servlet.ServletException
 */
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  if (!(request instanceof HttpServletRequest)) {
    chain.doFilter(request,response);
    return;
  }
  HttpServletRequest hrequest=(HttpServletRequest)request;
  HttpServletResponse hresponse=(HttpServletResponse)response;
  ESAPI.httpUtilities().setCurrentHTTP(hrequest,hresponse);
  chain.doFilter(ESAPI.currentRequest(),ESAPI.currentResponse());
}

Fixed version (ground truth):
/** 
 * @param request
 * @param response
 * @param chain
 * @throws java.io.IOException
 * @throws javax.servlet.ServletException
 */
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  if (!(request instanceof HttpServletRequest)) {
    chain.doFilter(request,response);
    return;
  }
  try {
    HttpServletRequest hrequest=(HttpServletRequest)request;
    HttpServletResponse hresponse=(HttpServletResponse)response;
    SecurityWrapperRequest secureRequest=new SecurityWrapperRequest(hrequest);
    SecurityWrapperResponse secureResponse=new SecurityWrapperResponse(hresponse);
    secureRequest.setAllowableContentRoot(allowableResourcesRoot);
    ESAPI.httpUtilities().setCurrentHTTP(secureRequest,secureResponse);
    chain.doFilter(ESAPI.currentRequest(),ESAPI.currentResponse());
  }
 catch (  Exception e) {
    logger.error(Logger.SECURITY_FAILURE,"String_Node_Str" + e.getMessage(),e);
    request.setAttribute("String_Node_Str",e.getMessage());
  }
 finally {
    ESAPI.httpUtilities().clearCurrent();
  }
}
Program: 31368
Project: 31368
Buggy source:
/** 
 * {@inheritDoc}
 * @param immune
 */
public String encodeCharacter(char[] immune,Character c){
  if (containsCharacter(c,immune)) {
    return "String_Node_Str" + c;
  }
  String hex=Codec.getHexForNonAlphanumeric(c);
  if (hex == null) {
    return "String_Node_Str" + c;
  }
  if (c < 0x10) {
    hex='0' + hex;
  }
  return '%' + hex;
}

Fixed version (ground truth):
/** 
 * Encode a character for URLs
 * @param immune characters not to encode
 * @param c character to encode
 * @return the encoded string representing c
 */
public String encodeCharacter(char[] immune,Character c){
  String cStr=String.valueOf(c.charValue());
  byte[] bytes;
  StringBuilder sb;
  if (UNENCODED_SET.contains(c))   return cStr;
  bytes=toUtf8Bytes(cStr);
  sb=new StringBuilder(bytes.length * 3);
  for (  byte b : bytes)   appendTwoUpperHex(sb.append('%'),b);
  return sb.toString();
}
Program: 31374
Project: 31374
Buggy source:
public DetectOutboundContentRule(String id,Pattern contentType,Pattern pattern,Pattern url){
  this.contentType=contentType;
  this.pattern=pattern;
  this.url=url;
  setId(id);
}

Fixed version (ground truth):
public DetectOutboundContentRule(String id,Pattern contentType,Pattern pattern,Pattern uri){
  this.contentType=contentType;
  this.pattern=pattern;
  this.uri=uri;
  setId(id);
}
Program: 31377
Project: 31377
Buggy source:
public Action check(HttpServletRequest request,InterceptingHTTPServletResponse response,HttpServletResponse httpResponse){
  String userAgent=request.getHeader(USER_AGENT_HEADER);
  if (userAgent == null)   userAgent="String_Node_Str";
  if (allow != null) {
    if (allow.matcher(userAgent).matches()) {
      return new DoNothingAction();
    }
  }
 else   if (deny != null) {
    if (!deny.matcher(userAgent).matches()) {
      return new DoNothingAction();
    }
  }
  log(request,"String_Node_Str" + deny.pattern() + "String_Node_Str"+ request.getHeader(USER_AGENT_HEADER)+ "String_Node_Str");
  return new DefaultAction();
}

Fixed version (ground truth):
public Action check(HttpServletRequest request,InterceptingHTTPServletResponse response,HttpServletResponse httpResponse){
  String userAgent=request.getHeader(USER_AGENT_HEADER);
  if (userAgent == null)   userAgent="String_Node_Str";
  if (allow != null) {
    if (allow.matcher(userAgent).matches()) {
      return new DoNothingAction();
    }
  }
 else   if (deny != null) {
    if (!deny.matcher(userAgent).matches()) {
      return new DoNothingAction();
    }
  }
  log(request,"String_Node_Str" + deny.pattern() + "String_Node_Str"+ request.getHeader(USER_AGENT_HEADER)+ "String_Node_Str");
  if (AppGuardianConfiguration.DEFAULT_FAIL_ACTION == AppGuardianConfiguration.REDIRECT) {
    return new BlockAction();
  }
  return new DefaultAction();
}
Program: 31378
Project: 31378
Buggy source:
/** 
 * Gets a file from the resource directory
 * @param filename The file name resource.
 * @return A {@code File} object representing the specified file name.
 */
public File getResourceFile(String filename);

Fixed version (ground truth):
/** 
 * Gets a file from the resource directory
 * @param filename The file name resource.
 * @return A {@code File} object representing the specified file name or null if not found.
 */
public File getResourceFile(String filename);
Program: 31381
Project: 31381
Buggy source:
/** 
 * Returns the decoded version of the character starting at index, or null if no decoding is possible. Formats all are legal both with and without semi-colon, upper/lower case: &aa; &aaa; &aaaa; &aaaaa; &aaaaaa; &aaaaaaa;
 * @param input A string containing a named entity like &quot;
 * @return Returns the decoded version of the character starting at index, or null if no decoding is possible.
 */
private Character getNamedEntity(PushbackString input){
  StringBuilder possible=new StringBuilder();
  int len=Math.min(input.remainder().length(),7);
  for (int i=0; i < len; i++) {
    possible.append(Character.toLowerCase(input.next().charValue()));
    Character entity=(Character)entityToCharacterMap.get(possible.toString());
    if (entity != null) {
      if (input.peek(';')) {
        input.next();
      }
      return entity;
    }
  }
  return null;
}

Fixed version (ground truth):
/** 
 * Returns the decoded version of the character starting at index, or null if no decoding is possible. Formats all are legal both with and without semi-colon, upper/lower case: &aa; &aaa; &aaaa; &aaaaa; &aaaaaa; &aaaaaaa;
 * @param input A string containing a named entity like &quot;
 * @return Returns the decoded version of the character starting at index, or null if no decoding is possible.
 */
private Character getNamedEntity(PushbackString input){
  StringBuilder possible=new StringBuilder();
  Map.Entry<CharSequence,Character> entry;
  int len;
  len=Math.min(input.remainder().length(),entityToCharacterMap.getMaxKeyLength());
  for (int i=0; i < len; i++)   possible.append(Character.toLowerCase(input.next()));
  entry=entityToCharacterMap.getLongestMatch(possible);
  if (entry == null)   return null;
  input.reset();
  input.next();
  len=entry.getKey().length();
  for (int i=0; i < len; i++)   input.next();
  if (input.peek(';'))   input.next();
  return entry.getValue();
}
Program: 31383
Project: 31383
Buggy source:
/** 
 * Create a new random reference that is guaranteed to be unique.
 * @return a random reference that is guaranteed to be unique
 */
private String getUniqueRandomReference(){
  String candidate=null;
  do {
    candidate=random.getRandomString(6,DefaultEncoder.CHAR_ALPHANUMERICS);
  }
 while (itod.keySet().contains(candidate));
  return candidate;
}

Fixed version (ground truth):
/** 
 * Create a new random reference that is guaranteed to be unique.
 * @return a random reference that is guaranteed to be unique
 */
private String getUniqueRandomReference(){
  String candidate=null;
  do {
    candidate=ESAPI.randomizer().getRandomString(6,DefaultEncoder.CHAR_ALPHANUMERICS);
  }
 while (itod.keySet().contains(candidate));
  return candidate;
}
Program: 31386
Project: 31386
Buggy source:
/** 
 * Load configuration.
 */
private void loadConfiguration() throws IOException {
  properties=loadPropertiesFromStream(getResourceStream("String_Node_Str"));
  Properties validationProperties=loadPropertiesFromStream(getResourceStream(getESAPIProperty(VALIDATION_PROPERTIES,"String_Node_Str")));
  Iterator i=validationProperties.keySet().iterator();
  while (i.hasNext()) {
    String key=(String)i.next();
    String value=validationProperties.getProperty(key);
    properties.put(key,value);
  }
  logSpecial("String_Node_Str",null);
  System.out.println("String_Node_Str" + DefaultSecurityConfiguration.resourceDirectory);
  Iterator j=new TreeSet(properties.keySet()).iterator();
  while (j.hasNext()) {
    String key=(String)j.next();
    if (!key.contains("String_Node_Str")) {
      logSpecial("String_Node_Str" + key + "String_Node_Str"+ properties.get(key),null);
    }
  }
}

Fixed version (ground truth):
/** 
 * Load configuration.
 */
private void loadConfiguration() throws IOException {
  properties=loadPropertiesFromStream(getResourceStream("String_Node_Str"));
  Properties validationProperties=loadPropertiesFromStream(getResourceStream(getESAPIProperty(VALIDATION_PROPERTIES,"String_Node_Str")));
  Iterator i=validationProperties.keySet().iterator();
  while (i.hasNext()) {
    String key=(String)i.next();
    String value=validationProperties.getProperty(key);
    properties.put(key,value);
  }
}
Program: 31388
Project: 31388
Buggy source:
/** 
 * Default constructor
 */
public Codec(){
  for (char c=0; c < 0xFF; c++) {
    if (c >= 0x30 && c <= 0x39 || c >= 0x41 && c <= 0x5A || c >= 0x61 && c <= 0x7A) {
      hex[c]=null;
    }
 else {
      hex[c]=toHex(c);
    }
  }
}

Fixed version (ground truth):
/** 
 * Default constructor
 */
public Codec(){
}
Program: 31390
Project: 31390
Buggy source:
public HTMLEntityCodec(){
  initializeMaps();
}

Fixed version (ground truth):
public HTMLEntityCodec(){
}
Program: 31391
Project: 31391
Buggy source:
/** 
 * Lookup the hex value of any character that is not alphanumeric, return null if alphanumeric.
 */
public static String getHex(char c){
  return hex[(int)c];
}

Fixed version (ground truth):
/** 
 * Lookup the hex value of any character that is not alphanumeric, return null if alphanumeric.
 */
public static String getHex(char c){
  if (c > 0xFF)   return null;
  return hex[c];
}
Program: 31392
Project: 31392
Buggy source:
/** 
 * Test of encodeForHTML method, of class org.owasp.esapi.Encoder.
 */
public void testEncodeForHTML() throws Exception {
  System.out.println("String_Node_Str");
  Encoder instance=ESAPI.encoder();
  assertEquals(null,instance.encodeForHTML(null));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str" + (char)0 + "String_Node_Str"+ (char)4+ "String_Node_Str"+ (char)128+ "String_Node_Str"+ (char)150+ "String_Node_Str"+ (char)159+ "String_Node_Str"+ (char)9+ "String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML(instance.canonicalize("String_Node_Str")));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
}

Fixed version (ground truth):
/** 
 * Test of encodeForHTML method, of class org.owasp.esapi.Encoder.
 */
public void testEncodeForHTML() throws Exception {
  System.out.println("String_Node_Str");
  Encoder instance=ESAPI.encoder();
  assertEquals(null,instance.encodeForHTML(null));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str" + (char)0 + "String_Node_Str"+ (char)4+ "String_Node_Str"+ (char)128+ "String_Node_Str"+ (char)150+ "String_Node_Str"+ (char)159+ "String_Node_Str"+ (char)9+ "String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML(instance.canonicalize("String_Node_Str")));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str",instance.encodeForHTML("String_Node_Str"));
  assertEquals("String_Node_Str" + (char)12345 + (char)65533+ (char)1244,"String_Node_Str" + (char)12345 + (char)65533+ (char)1244);
}
Program: 31395
Project: 31395
Buggy source:
/** 
 * Returns the array of matching parameter values from the HttpServletRequest after canonicalizing and filtering out any dangerous characters.
 */
public String[] getParameterValues(String name){
  String[] values=request.getParameterValues(name);
  List newValues=new ArrayList();
  if (values != null) {
    for (int i=0; i < values.length; i++) {
      try {
        String value=values[i];
        String cleanValue=ESAPI.validator().getValidInput("String_Node_Str" + value,value,"String_Node_Str",2000,false);
        newValues.add(cleanValue);
      }
 catch (      ValidationException e) {
        logger.warning(Logger.SECURITY,false,"String_Node_Str");
      }
    }
  }
  return (String[])newValues.toArray();
}

Fixed version (ground truth):
/** 
 * Returns the array of matching parameter values from the HttpServletRequest after canonicalizing and filtering out any dangerous characters.
 */
public String[] getParameterValues(String name){
  String[] values=request.getParameterValues(name);
  List newValues=new ArrayList();
  if (values != null) {
    for (int i=0; i < values.length; i++) {
      try {
        String value=values[i];
        String cleanValue=ESAPI.validator().getValidInput("String_Node_Str" + value,value,"String_Node_Str",2000,false);
        newValues.add(cleanValue);
      }
 catch (      ValidationException e) {
        logger.warning(Logger.SECURITY,false,"String_Node_Str");
      }
    }
  }
  return (String[])newValues.toArray(new String[0]);
}
Program: 31396
Project: 31396
Buggy source:
/** 
 * {@inheritDoc}Checks if an account is authorized to access the referenced file. The implementation should validate and canonicalize the  input to be sure the filepath is not malicious. <P> This method throws an AccessControlException if access is not authorized, or if the referenced File does not exist. If the User is authorized, this method simply returns. <P> Specification:  The implementation should do the following: <ol> <li>Check to see if the File exists and if not, throw an AccessControlException</li> <li>Use available information to make an access control decision</li> <ol type="a"> <li>Ideally, this policy would be data driven</li> <li>You can use the current User, roles, data type, data name, time of day, etc.</li> <li>Access control decisions must deny by default</li> </ol> <li>If access is not permitted, throw an AccessControlException with details</li> </ol> 
 */
void assertAuthorizedForFile(String filepath) throws AccessControlException ;

Fixed version (ground truth):
/** 
 * Checks if an account is authorized to access the referenced file. The implementation should validate and canonicalize the  input to be sure the filepath is not malicious. <P> This method throws an AccessControlException if access is not authorized, or if the referenced File does not exist. If the User is authorized, this method simply returns. <P> Specification:  The implementation should do the following: <ol> <li>Check to see if the File exists and if not, throw an AccessControlException</li> <li>Use available information to make an access control decision</li> <ol type="a"> <li>Ideally, this policy would be data driven</li> <li>You can use the current User, roles, data type, data name, time of day, etc.</li> <li>Access control decisions must deny by default</li> </ol> <li>If access is not permitted, throw an AccessControlException with details</li> </ol> 
 * @param filepath Path to the file to be checked
 * @throws AccessControlException if access is denied
 */
void assertAuthorizedForFile(String filepath) throws AccessControlException ;
Program: 31397
Project: 31397
Buggy source:
/** 
 * {@inheritdoc}
 */
protected void setUp() throws Exception {
}

Fixed version (ground truth):
/** 
 * {@inheritDoc}
 */
protected void setUp() throws Exception {
}
Program: 31398
Project: 31398
Buggy source:
/** 
 * {@inheritDoc}
 */
public void removeParameter(String name){
  parameters.remove(name);
}

Fixed version (ground truth):
/** 
 * removeParameter removes the parameter name from the parameters map if it exists
 * @param name parameter name to be removed
 */
public void removeParameter(String name){
  parameters.remove(name);
}
Program: 31399
Project: 31399
Buggy source:
/** 
 * Returns the decoded version of the character starting at index, or null if no decoding is possible. Formats all are legal both upper/lower case: \\x - special characters \\HHHH
 */
public Character decodeCharacter(PushbackString input){
  input.mark();
  Character first=input.next();
  if (first == null) {
    input.reset();
    return null;
  }
  if (first.charValue() != '\\') {
    input.reset();
    return null;
  }
  Character second=input.next();
  if (second == null) {
    input.reset();
    return null;
  }
  if (input.isHexDigit(second)) {
    StringBuffer sb=new StringBuffer();
    sb.append(second);
    for (int i=0; i < 5; i++) {
      Character c=input.next();
      if (c == null || c.charValue() == 0x20)       break;
      if (input.isHexDigit(c)) {
        sb.append(c);
      }
 else {
        input.pushback(c);
        break;
      }
    }
    try {
      int i=Integer.parseInt(sb.toString(),16);
      return new Character((char)i);
    }
 catch (    NumberFormatException e) {
    }
  }
  return second;
}

Fixed version (ground truth):
/** 
 * Returns the decoded version of the character starting at index, or null if no decoding is possible. Formats all are legal both upper/lower case: \\x - special characters \\HHHH
 */
public Character decodeCharacter(PushbackString input){
  input.mark();
  Character first=input.next();
  if (first == null) {
    input.reset();
    return null;
  }
  if (first.charValue() != '\\') {
    input.reset();
    return null;
  }
  Character second=input.next();
  if (second == null) {
    input.reset();
    return null;
  }
  System.out.println("String_Node_Str" + second);
  if (input.isHexDigit(second)) {
    StringBuffer sb=new StringBuffer();
    sb.append(second);
    for (int i=0; i < 5; i++) {
      Character c=input.next();
      if (c == null || c.charValue() == 0x20)       break;
      if (input.isHexDigit(c)) {
        sb.append(c);
      }
 else {
        input.pushback(c);
        break;
      }
    }
    try {
      int i=Integer.parseInt(sb.toString(),16);
      return new Character((char)i);
    }
 catch (    NumberFormatException e) {
    }
  }
  return second;
}
Program: 31401
Project: 31401
Buggy source:
/** 
 * @return the validatorErrorList
 */
public ValidatorErrorList getValidatorErrorList(){
  return (ValidatorErrorList)validatorErrorList.get();
}

Fixed version (ground truth):
/** 
 * @return the validatorErrorList
 */
public ValidatorErrorList getValidatorErrorList(){
  return (ValidatorErrorList)validatorErrorList.getValidatorErrorList();
}
Program: 31402
Project: 31402
Buggy source:
/** 
 * Returns canonicalized and validated printable characters as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack will generate a descriptive IntrusionException. 
 */
public String getValidPrintable(String context,String input,int maxLength,boolean allowNull) throws ValidationException, IntrusionException {
  String canonical="String_Node_Str";
  try {
    canonical=ESAPI.encoder().canonicalize(input);
    getValidPrintable(context,canonical.getBytes(),maxLength,allowNull);
  }
 catch (  EncodingException e) {
    logger.logError(Logger.SECURITY,"String_Node_Str",e);
  }
  return canonical;
}

Fixed version (ground truth):
/** 
 * Returns canonicalized and validated printable characters as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack will generate a descriptive IntrusionException. 
 */
public String getValidPrintable(String context,String input,int maxLength,boolean allowNull) throws ValidationException, IntrusionException {
  String canonical="String_Node_Str";
  try {
    canonical=ESAPI.encoder().canonicalize(input);
    return new String(getValidPrintable(context,canonical.getBytes(),maxLength,allowNull));
  }
 catch (  EncodingException e) {
    throw new ValidationException("String_Node_Str" + context,"String_Node_Str" + context + "String_Node_Str"+ input,e);
  }
}
Program: 31403
Project: 31403
Buggy source:
/** 
 * Returns true if input is a valid file name. FIXME: AAA - need new method getValidFileName that eliminates %00 and other injections. FIXME: AAA - this method should check for %00 injection too
 */
public boolean isValidFileName(String context,String input,boolean allowNull) throws IntrusionException {
  try {
    getValidFileName(context,input,allowNull);
    return true;
  }
 catch (  Exception e) {
    return false;
  }
}

Fixed version (ground truth):
/** 
 * Returns true if input is a valid file name.
 */
public boolean isValidFileName(String context,String input,boolean allowNull) throws IntrusionException {
  try {
    getValidFileName(context,input,allowNull);
    return true;
  }
 catch (  Exception e) {
    return false;
  }
}
Program: 31404
Project: 31404
Buggy source:
/** 
 * Load rules.
 * @param f the f
 * @return the hash map
 * @throws AccessControlException the access control exception
 */
private Map loadRules(File f) throws AccessControlException {
  Map map=new HashMap();
  BufferedReader reader=null;
  try {
    reader=new BufferedReader(new FileReader(f));
    String line="String_Node_Str";
    while ((line=reader.readLine()) != null) {
      if (line.length() > 0 && line.charAt(0) != '#') {
        Rule rule=new Rule();
        String[] parts=line.split("String_Node_Str");
        rule.path=parts[0].trim().replaceAll("String_Node_Str","String_Node_Str");
        rule.roles.add(parts[1].trim().toLowerCase());
        String action=parts[2].trim();
        rule.allow=action.equalsIgnoreCase("String_Node_Str");
        if (map.containsKey(rule.path)) {
          throw new AccessControlException("String_Node_Str","String_Node_Str" + rule);
        }
        map.put(rule.path,rule);
      }
    }
    return map;
  }
 catch (  IOException e) {
    throw new AccessControlException("String_Node_Str","String_Node_Str" + f,e);
  }
 finally {
    try {
      if (reader != null)       reader.close();
    }
 catch (    IOException e) {
      logger.logWarning(Logger.SECURITY,"String_Node_Str" + f,e);
    }
  }
}

Fixed version (ground truth):
/** 
 * Load rules.
 * @param f the f
 * @return the hash map
 * @throws AccessControlException the access control exception
 */
private Map loadRules(File f) throws AccessControlException {
  Map map=new HashMap();
  FileInputStream fis=null;
  try {
    fis=new FileInputStream(f);
    String line="String_Node_Str";
    while ((line=Validator.getInstance().safeReadLine(fis,500)) != null) {
      if (line.length() > 0 && line.charAt(0) != '#') {
        System.out.println("String_Node_Str" + line);
        Rule rule=new Rule();
        String[] parts=line.split("String_Node_Str");
        rule.path=parts[0].trim().replaceAll("String_Node_Str","String_Node_Str");
        rule.roles.add(parts[1].trim().toLowerCase());
        String action=parts[2].trim();
        rule.allow=action.equalsIgnoreCase("String_Node_Str");
        if (map.containsKey(rule.path)) {
          throw new AccessControlException("String_Node_Str","String_Node_Str" + rule);
        }
        map.put(rule.path,rule);
      }
    }
    return map;
  }
 catch (  IOException e) {
    throw new AccessControlException("String_Node_Str","String_Node_Str" + f,e);
  }
catch (  ValidationException e1) {
    throw new AccessControlException("String_Node_Str","String_Node_Str" + f,e1);
  }
 finally {
    try {
      if (fis != null) {
        fis.close();
      }
    }
 catch (    IOException e) {
      logger.logWarning(Logger.SECURITY,"String_Node_Str" + f,e);
    }
  }
}
Program: 31405
Project: 31405
Buggy source:
/** 
 * This implementation reads until a newline or the specified number of characters.
 * @param in the in
 * @param max the max
 * @return the string
 * @throws ValidationException the validation exception
 * @see org.owasp.esapi.interfaces.IValidator#safeReadLine(java.io.InputStream,int)
 */
public String safeReadLine(InputStream in,int max) throws ValidationException {
  if (max <= 0)   throw new ValidationAvailabilityException("String_Node_Str","String_Node_Str");
  StringBuffer sb=new StringBuffer();
  int count=0;
  int c;
  try {
    while ((c=in.read()) != -1) {
      sb.append((char)c);
      count++;
      if (count > max)       throw new ValidationAvailabilityException("String_Node_Str","String_Node_Str" + max + "String_Node_Str");
      if (c == '\n')       break;
    }
    return sb.toString();
  }
 catch (  IOException e) {
    throw new ValidationAvailabilityException("String_Node_Str","String_Node_Str",e);
  }
}

Fixed version (ground truth):
/** 
 * This implementation reads until a newline or the specified number of characters.
 * @param in the in
 * @param max the max
 * @return the string
 * @throws ValidationException the validation exception
 * @see org.owasp.esapi.interfaces.IValidator#safeReadLine(java.io.InputStream,int)
 */
public String safeReadLine(InputStream in,int max) throws ValidationException {
  if (max <= 0)   throw new ValidationAvailabilityException("String_Node_Str","String_Node_Str");
  StringBuffer sb=new StringBuffer();
  int count=0;
  int c;
  try {
    while (true) {
      c=in.read();
      if (c == -1)       return null;
      if (c == '\n' || c == '\r')       break;
      sb.append((char)c);
      count++;
      if (count > max) {
        throw new ValidationAvailabilityException("String_Node_Str","String_Node_Str" + max + "String_Node_Str");
      }
    }
    return sb.toString();
  }
 catch (  IOException e) {
    throw new ValidationAvailabilityException("String_Node_Str","String_Node_Str",e);
  }
}