Program: 31373
Project: 31373
Buggy source:
/** 
 * This is the where the main interception and rule-checking logic of the WAF resides.
 */
public void doFilter(ServletRequest servletRequest,ServletResponse servletResponse,FilterChain chain) throws IOException, ServletException {
  if ((System.currentTimeMillis() - lastConfigReadTime) > pollingTime) {
    File f=new File(configurationFilename);
    if (f.lastModified() > lastConfigReadTime) {
      logger.debug("String_Node_Str");
      init(fc);
    }
  }
  logger.debug("String_Node_Str");
  HttpServletRequest httpRequest=(HttpServletRequest)servletRequest;
  HttpServletResponse httpResponse=(HttpServletResponse)servletResponse;
  InterceptingHTTPServletRequest request=null;
  InterceptingHTTPServletResponse response=null;
  if (appGuardConfig.getCookieRules().size() + appGuardConfig.getBeforeResponseRules().size() > 0) {
    response=new InterceptingHTTPServletResponse(httpResponse,true,appGuardConfig.getCookieRules());
  }
  logger.debug("String_Node_Str");
  List<Rule> rules=this.appGuardConfig.getBeforeBodyRules();
  for (int i=0; i < rules.size(); i++) {
    Rule rule=rules.get(i);
    logger.debug("String_Node_Str" + rule.getClass().getName());
    Action action=rule.check(httpRequest,response,httpResponse);
    if (action.isActionNecessary()) {
      if (action instanceof BlockAction) {
        return;
      }
 else       if (action instanceof RedirectAction) {
        sendRedirect(response,httpResponse,((RedirectAction)action).getRedirectURL());
        return;
      }
 else       if (action instanceof DefaultAction) {
switch (AppGuardianConfiguration.DEFAULT_FAIL_ACTION) {
case AppGuardianConfiguration.BLOCK:
          return;
case AppGuardianConfiguration.REDIRECT:
        sendRedirect(response,httpResponse);
      return;
  }
}
}
}
try {
request=new InterceptingHTTPServletRequest((HttpServletRequest)servletRequest);
}
 catch (FileUploadException fue) {
fue.printStackTrace();
}
logger.debug("String_Node_Str");
rules=this.appGuardConfig.getAfterBodyRules();
for (int i=0; i < rules.size(); i++) {
Rule rule=rules.get(i);
logger.debug("String_Node_Str" + rule.getClass().getName());
Action action=rule.check(request,response,httpResponse);
if (action.isActionNecessary()) {
if (action instanceof BlockAction) {
  return;
}
 else if (action instanceof RedirectAction) {
  sendRedirect(response,httpResponse,((RedirectAction)action).getRedirectURL());
  return;
}
 else if (action instanceof DefaultAction) {
switch (AppGuardianConfiguration.DEFAULT_FAIL_ACTION) {
case AppGuardianConfiguration.BLOCK:
    return;
case AppGuardianConfiguration.REDIRECT:
  sendRedirect(response,httpResponse);
return;
}
}
}
}
logger.debug("String_Node_Str" + chain);
chain.doFilter(request,response != null ? response : httpResponse);
logger.debug("String_Node_Str");
rules=this.appGuardConfig.getBeforeResponseRules();
for (int i=0; i < rules.size(); i++) {
Rule rule=rules.get(i);
logger.debug("String_Node_Str" + rule.getClass().getName());
Action action=rule.check(request,response,httpResponse);
if (action.isActionNecessary()) {
if (action instanceof BlockAction) {
return;
}
 else if (action instanceof RedirectAction) {
sendRedirect(response,httpResponse,((RedirectAction)action).getRedirectURL());
return;
}
 else if (action instanceof DefaultAction) {
switch (AppGuardianConfiguration.DEFAULT_FAIL_ACTION) {
case AppGuardianConfiguration.BLOCK:
return;
case AppGuardianConfiguration.REDIRECT:
sendRedirect(response,httpResponse);
return;
}
}
}
}
if (response != null) {
logger.debug("String_Node_Str");
response.commit();
}
}

Fixed version (ground truth):
/** 
 * This is the where the main interception and rule-checking logic of the WAF resides.
 */
public void doFilter(ServletRequest servletRequest,ServletResponse servletResponse,FilterChain chain) throws IOException, ServletException {
  if ((System.currentTimeMillis() - lastConfigReadTime) > pollingTime) {
    File f=new File(configurationFilename);
    long lastModified=f.lastModified();
    if (lastModified > lastConfigReadTime) {
      logger.debug("String_Node_Str");
      init(fc);
    }
  }
  logger.debug("String_Node_Str");
  HttpServletRequest httpRequest=(HttpServletRequest)servletRequest;
  HttpServletResponse httpResponse=(HttpServletResponse)servletResponse;
  InterceptingHTTPServletRequest request=null;
  InterceptingHTTPServletResponse response=null;
  if (appGuardConfig.getCookieRules().size() + appGuardConfig.getBeforeResponseRules().size() > 0) {
    response=new InterceptingHTTPServletResponse(httpResponse,true,appGuardConfig.getCookieRules());
  }
  logger.debug("String_Node_Str");
  List<Rule> rules=this.appGuardConfig.getBeforeBodyRules();
  for (int i=0; i < rules.size(); i++) {
    Rule rule=rules.get(i);
    logger.debug("String_Node_Str" + rule.getClass().getName());
    Action action=rule.check(httpRequest,response,httpResponse);
    if (action.isActionNecessary()) {
      if (action instanceof BlockAction) {
        return;
      }
 else       if (action instanceof RedirectAction) {
        sendRedirect(response,httpResponse,((RedirectAction)action).getRedirectURL());
        return;
      }
 else       if (action instanceof DefaultAction) {
switch (AppGuardianConfiguration.DEFAULT_FAIL_ACTION) {
case AppGuardianConfiguration.BLOCK:
          return;
case AppGuardianConfiguration.REDIRECT:
        sendRedirect(response,httpResponse);
      return;
  }
}
}
}
try {
request=new InterceptingHTTPServletRequest((HttpServletRequest)servletRequest);
}
 catch (FileUploadException fue) {
fue.printStackTrace();
}
logger.debug("String_Node_Str");
rules=this.appGuardConfig.getAfterBodyRules();
for (int i=0; i < rules.size(); i++) {
Rule rule=rules.get(i);
logger.debug("String_Node_Str" + rule.getClass().getName());
Action action=rule.check(request,response,httpResponse);
if (action.isActionNecessary()) {
if (action instanceof BlockAction) {
  return;
}
 else if (action instanceof RedirectAction) {
  sendRedirect(response,httpResponse,((RedirectAction)action).getRedirectURL());
  return;
}
 else if (action instanceof DefaultAction) {
switch (AppGuardianConfiguration.DEFAULT_FAIL_ACTION) {
case AppGuardianConfiguration.BLOCK:
    return;
case AppGuardianConfiguration.REDIRECT:
  sendRedirect(response,httpResponse);
return;
}
}
}
}
logger.debug("String_Node_Str" + chain);
chain.doFilter(request,response != null ? response : httpResponse);
logger.debug("String_Node_Str");
rules=this.appGuardConfig.getBeforeResponseRules();
for (int i=0; i < rules.size(); i++) {
Rule rule=rules.get(i);
logger.debug("String_Node_Str" + rule.getClass().getName());
Action action=rule.check(request,response,httpResponse);
if (action.isActionNecessary()) {
if (action instanceof BlockAction) {
return;
}
 else if (action instanceof RedirectAction) {
sendRedirect(response,httpResponse,((RedirectAction)action).getRedirectURL());
return;
}
 else if (action instanceof DefaultAction) {
switch (AppGuardianConfiguration.DEFAULT_FAIL_ACTION) {
case AppGuardianConfiguration.BLOCK:
return;
case AppGuardianConfiguration.REDIRECT:
sendRedirect(response,httpResponse);
return;
}
}
}
}
if (response != null) {
logger.debug("String_Node_Str");
response.commit();
}
}