Program: 9259
Project: 9259
Buggy source:
/** 
 * Encodes the url by adding the cookiename=sid to it. if cookie support is true returns without encoding <p> The cookie Value is written in the URL based on the encodingScheme specified. The Cookie Value could be written as path info separated by either a "/" OR  ";" or as a query string. <p> If the encoding scheme is SLASH then the  cookie value would be written in the URL as extra path info in the following format: <pre> protocol://server:port/servletpath/&lt;cookieName>=&lt;cookieValue>? queryString      </pre> <p> Note that this format works only if the path is a servlet, if a a jsp file is specified then webcontainers return with "File Not found" error. To rewrite links which are JSP files with cookie value use the SEMICOLON OR QUERY encoding scheme.      <p> If the encoding scheme is SEMICOLON then the cookie value would be written in the URL as extra path info in the following format: <pre> protocol://server:port/path;&lt;cookieName=cookieValue>?queryString </pre> Note that this is not supported in the servlet specification and some web containers do not support this. <p> If the encoding scheme is QUERY then the cookie value would be written in the URL in the following format: <pre> protocol://server:port/path?&lt;cookieName>=&lt;cookieValue> protocol://server:port/path?queryString&&lt;cookieName>=&lt;cookieValue> </pre> <p> This is the default and OpenSSO always encodes in this format  unless otherwise specified. If the URL passed in has query parameter then entity escaping of ampersand will be done before appending the cookie if the escape is true.  Only the ampersand before appending  cookie parameter will be entity escaped. <p>
 * @param url the url to be encoded
 * @param encodingScheme possible values are QUERY,SLASH,SEMICOLON
 * @param escape entity escaping of ampersand when appending theSSOToken ID to request query string.
 * @param cookieName 
 * @return encoded URL with cookie value (session id) basedon the encoding scheme or the url itself if there is an error.
 */
public String encodeURL(String url,short encodingScheme,boolean escape,String cookieName){
  if (DEBUG.messageEnabled()) {
    DEBUG.message("String_Node_Str" + url);
  }
  String encodedURL=url;
  if (((url != null) && (url.length() > 0)) && !getCookieSupport()) {
    if ((cookieStr != null && cookieStr.length() != 0) && (Session.foundCookieName(cookieStr,cookieName))) {
      encodedURL=SessionEncodeURL.buildCookieString(url,cookieStr,encodingScheme,escape);
    }
 else {
      if (sessionID != null) {
        cookieStr=SessionEncodeURL.createCookieString(cookieName,sessionID.toString());
        encodedURL=SessionEncodeURL.encodeURL(cookieStr,url,encodingScheme,escape);
      }
    }
  }
  if (DEBUG.messageEnabled()) {
    DEBUG.message("String_Node_Str" + "String_Node_Str" + encodedURL);
  }
  return encodedURL;
}

Fixed version (ground truth):
/** 
 * Encodes the url by adding the cookiename=sid to it. if cookie support is true returns without encoding <p> The cookie Value is written in the URL based on the encodingScheme specified. The Cookie Value could be written as path info separated by either a "/" OR  ";" or as a query string. <p> If the encoding scheme is SLASH then the  cookie value would be written in the URL as extra path info in the following format: <pre> protocol://server:port/servletpath/&lt;cookieName>=&lt;cookieValue>? queryString      </pre> <p> Note that this format works only if the path is a servlet, if a a jsp file is specified then webcontainers return with "File Not found" error. To rewrite links which are JSP files with cookie value use the SEMICOLON OR QUERY encoding scheme.      <p> If the encoding scheme is SEMICOLON then the cookie value would be written in the URL as extra path info in the following format: <pre> protocol://server:port/path;&lt;cookieName=cookieValue>?queryString </pre> Note that this is not supported in the servlet specification and some web containers do not support this. <p> If the encoding scheme is QUERY then the cookie value would be written in the URL in the following format: <pre> protocol://server:port/path?&lt;cookieName>=&lt;cookieValue> protocol://server:port/path?queryString&&lt;cookieName>=&lt;cookieValue> </pre> <p> This is the default and OpenSSO always encodes in this format  unless otherwise specified. If the URL passed in has query parameter then entity escaping of ampersand will be done before appending the cookie if the escape is true.  Only the ampersand before appending  cookie parameter will be entity escaped. <p>
 * @param url the url to be encoded
 * @param encodingScheme possible values are QUERY,SLASH,SEMICOLON
 * @param escape entity escaping of ampersand when appending theSSOToken ID to request query string.
 * @param cookieName 
 * @return encoded URL with cookie value (session id) basedon the encoding scheme or the url itself if there is an error.
 */
public String encodeURL(String url,short encodingScheme,boolean escape,String cookieName){
  if (debug.messageEnabled()) {
    debug.message("String_Node_Str" + url);
  }
  String encodedURL=url;
  if (((url != null) && (url.length() > 0)) && !getCookieSupport()) {
    if ((cookieStr != null && cookieStr.length() != 0) && (Session.foundCookieName(cookieStr,cookieName))) {
      encodedURL=SessionEncodeURL.buildCookieString(url,cookieStr,encodingScheme,escape);
    }
 else {
      if (sessionID != null) {
        cookieStr=SessionEncodeURL.createCookieString(cookieName,sessionID.toString());
        encodedURL=SessionEncodeURL.encodeURL(cookieStr,url,encodingScheme,escape);
      }
    }
  }
  if (debug.messageEnabled()) {
    debug.message("String_Node_Str" + "String_Node_Str" + encodedURL);
  }
  return encodedURL;
}