Program: 48136
Project: 48136
Buggy source:
/** 
 * The DIDList function returns a list of the existing DIDs in the card application addressed by the ConnectionHandle or the ApplicationIdentifier element within the Filter. See BSI-TR-03112-4, version 1.1.2, section 3.6.1.
 * @param request DIDList
 * @return DIDListResponse
 */
@Override public DIDListResponse didList(DIDList request){
  DIDListResponse response=WSHelper.makeResponse(DIDListResponse.class,WSHelper.makeResultOK());
  try {
    ConnectionHandleType connectionHandle=SALUtils.getConnectionHandle(request);
    byte[] appId=connectionHandle.getCardApplication();
    CardStateEntry cardStateEntry=SALUtils.getCardStateEntry(states,connectionHandle,false);
    Assert.securityConditionApplication(cardStateEntry,appId,DifferentialIdentityServiceActionName.DID_LIST);
    byte[] applicationIDFilter=null;
    String objectIDFilter=null;
    String applicationFunctionFilter=null;
    DIDQualifierType didQualifier=request.getFilter();
    if (didQualifier != null) {
      applicationIDFilter=didQualifier.getApplicationIdentifier();
      objectIDFilter=didQualifier.getObjectIdentifier();
      applicationFunctionFilter=didQualifier.getApplicationFunction();
    }
    CardApplicationWrapper cardApplication;
    if (applicationIDFilter != null) {
      cardApplication=cardStateEntry.getInfo().getCardApplication(applicationIDFilter);
      Assert.assertIncorrectParameter(cardApplication,"String_Node_Str");
    }
 else {
      cardApplication=cardStateEntry.getCurrentCardApplication();
    }
    List<DIDInfoType> didInfos=new ArrayList<DIDInfoType>(cardApplication.getDIDInfoList());
    if (objectIDFilter != null) {
      Iterator<DIDInfoType> it=didInfos.iterator();
      while (it.hasNext()) {
        DIDInfoType next=it.next();
        if (!next.getDifferentialIdentity().getDIDProtocol().equals(objectIDFilter)) {
          it.remove();
        }
      }
    }
    if (applicationFunctionFilter != null) {
      Iterator<DIDInfoType> it=didInfos.iterator();
      while (it.hasNext()) {
        DIDInfoType next=it.next();
        if (next.getDifferentialIdentity().getDIDMarker().getCryptoMarker() == null) {
          it.remove();
        }
 else {
          iso.std.iso_iec._24727.tech.schema.CryptoMarkerType rawMarker;
          rawMarker=next.getDifferentialIdentity().getDIDMarker().getCryptoMarker();
          CryptoMarkerType cryptoMarker=new CryptoMarkerType(rawMarker);
          AlgorithmInfoType algInfo=cryptoMarker.getAlgorithmInfo();
          if (!algInfo.getSupportedOperations().contains(applicationFunctionFilter)) {
            it.remove();
          }
        }
      }
    }
    DIDNameListType didNameList=new DIDNameListType();
    for (    DIDInfoType didInfo : didInfos) {
      didNameList.getDIDName().add(didInfo.getDifferentialIdentity().getDIDName());
    }
    response.setDIDNameList(didNameList);
  }
 catch (  ECardException e) {
    response.setResult(e.getResult());
  }
catch (  Exception e) {
    logger.error(e.getMessage(),e);
    response.setResult(WSHelper.makeResult(e));
  }
  return response;
}

Fixed version (ground truth):
/** 
 * The DIDList function returns a list of the existing DIDs in the card application addressed by the ConnectionHandle or the ApplicationIdentifier element within the Filter. See BSI-TR-03112-4, version 1.1.2, section 3.6.1.
 * @param request DIDList
 * @return DIDListResponse
 */
@Override public DIDListResponse didList(DIDList request){
  DIDListResponse response=WSHelper.makeResponse(DIDListResponse.class,WSHelper.makeResultOK());
  try {
    ConnectionHandleType connectionHandle=SALUtils.getConnectionHandle(request);
    byte[] appId=connectionHandle.getCardApplication();
    CardStateEntry cardStateEntry=SALUtils.getCardStateEntry(states,connectionHandle,false);
    Assert.securityConditionApplication(cardStateEntry,appId,DifferentialIdentityServiceActionName.DID_LIST);
    byte[] applicationIDFilter=null;
    String objectIDFilter=null;
    String applicationFunctionFilter=null;
    DIDQualifierType didQualifier=request.getFilter();
    if (didQualifier != null) {
      applicationIDFilter=didQualifier.getApplicationIdentifier();
      objectIDFilter=didQualifier.getObjectIdentifier();
      applicationFunctionFilter=didQualifier.getApplicationFunction();
    }
    CardApplicationWrapper cardApplication;
    if (applicationIDFilter != null) {
      cardApplication=cardStateEntry.getInfo().getCardApplication(applicationIDFilter);
      Assert.assertIncorrectParameter(cardApplication,"String_Node_Str");
    }
 else {
      cardApplication=cardStateEntry.getCurrentCardApplication();
    }
    List<DIDInfoType> didInfos=new ArrayList<>(cardApplication.getDIDInfoList());
    if (objectIDFilter != null) {
      Iterator<DIDInfoType> it=didInfos.iterator();
      while (it.hasNext()) {
        DIDInfoType next=it.next();
        if (!next.getDifferentialIdentity().getDIDProtocol().equals(objectIDFilter)) {
          it.remove();
        }
      }
    }
    if (applicationFunctionFilter != null) {
      Iterator<DIDInfoType> it=didInfos.iterator();
      while (it.hasNext()) {
        DIDInfoType next=it.next();
        if (next.getDifferentialIdentity().getDIDMarker().getCryptoMarker() == null) {
          it.remove();
        }
 else {
          iso.std.iso_iec._24727.tech.schema.CryptoMarkerType rawMarker;
          rawMarker=next.getDifferentialIdentity().getDIDMarker().getCryptoMarker();
          CryptoMarkerType cryptoMarker=new CryptoMarkerType(rawMarker);
          AlgorithmInfoType algInfo=cryptoMarker.getAlgorithmInfo();
          if (!algInfo.getSupportedOperations().contains(applicationFunctionFilter)) {
            it.remove();
          }
        }
      }
    }
    DIDNameListType didNameList=new DIDNameListType();
    for (    DIDInfoType didInfo : didInfos) {
      didNameList.getDIDName().add(didInfo.getDifferentialIdentity().getDIDName());
    }
    response.setDIDNameList(didNameList);
  }
 catch (  ECardException e) {
    response.setResult(e.getResult());
  }
catch (  Exception e) {
    logger.error(e.getMessage(),e);
    response.setResult(WSHelper.makeResult(e));
  }
  return response;
}