Program: 9100
Project: 9100
Buggy source:
/** 
 * For token transformations with x509 certificates as an input token type, a client's identity can only be asserted via x509 certificates presented via two-way-tls. This certificate can be obtained via the attribute referenced by the javax.servlet.request.X509Certificate key (if the container is deployed with two-way-tls), or from the header referenced by offloadedTlsClientCertKey, in case OpenAM is deployed behind infrastructure which performs tls-offloading. This method will consult header value if configured for this rest-sts instance, and if not configured, the ClientInfoContxt will be consulted, which contains the state corresponding to the javax.servlet.request.X509Certificate attribute. An exception will be thrown if the client cert cannot be obtained.
 * @param context The Context instance corresponding to this invocation
 * @throws org.forgerock.openam.sts.TokenMarshalException if the client's X509 token cannot be obtained from thejavax.servlet.request.X509Certificate attribute, or from the header referenced by the offloadedTlsClientCertKey value.
 * @return a RestTokenTransformValidatorParameters instance with a X509Certificate[] generic type.
 */
private RestTokenTransformValidatorParameters<X509Certificate[]> buildX509CertTokenTransformValidatorParameters(Context context) throws TokenMarshalException {
  X509Certificate[] certificates;
  if (!"String_Node_Str".equals(offloadedTlsClientCertKey)) {
    String clientIpAddress=ClientUtils.getClientIPAddress(context);
    if (!tlsOffloadEngineHosts.contains(clientIpAddress) && !tlsOffloadEngineHosts.contains(ANY_HOST)) {
      logger.error("String_Node_Str" + "String_Node_Str" + offloadedTlsClientCertKey + "String_Node_Str"+ "String_Node_Str"+ clientIpAddress+ "String_Node_Str"+ tlsOffloadEngineHosts);
      throw new TokenMarshalException(ResourceException.BAD_REQUEST,"String_Node_Str" + "String_Node_Str" + "String_Node_Str");
    }
    certificates=pullClientCertFromHeader(context.asContext(HttpContext.class));
  }
 else {
    certificates=pullClientCertFromRequestAttribute(context.asContext(ClientContext.class));
  }
  if (certificates != null) {
    return marshalX509CertIntoTokenValidatorParameters(certificates);
  }
 else {
    if (!"String_Node_Str".equals(offloadedTlsClientCertKey)) {
      throw new TokenMarshalException(ResourceException.BAD_REQUEST,"String_Node_Str" + "String_Node_Str" + "String_Node_Str"+ "String_Node_Str");
    }
 else {
      throw new TokenMarshalException(ResourceException.BAD_REQUEST,"String_Node_Str" + "String_Node_Str" + offloadedTlsClientCertKey + "String_Node_Str"+ "String_Node_Str");
    }
  }
}

Fixed version (ground truth):
/** 
 * For token transformations with x509 certificates as an input token type, a client's identity can only be asserted via x509 certificates presented via two-way-tls. This certificate can be obtained via the attribute referenced by the javax.servlet.request.X509Certificate key (if the container is deployed with two-way-tls), or from the header referenced by offloadedTlsClientCertKey, in case OpenAM is deployed behind infrastructure which performs tls-offloading. This method will consult header value if configured for this rest-sts instance, and if not configured, the ClientInfoContxt will be consulted, which contains the state corresponding to the javax.servlet.request.X509Certificate attribute. An exception will be thrown if the client cert cannot be obtained.
 * @param context The Context instance corresponding to this invocation
 * @throws org.forgerock.openam.sts.TokenMarshalException if the client's X509 token cannot be obtained from thejavax.servlet.request.X509Certificate attribute, or from the header referenced by the offloadedTlsClientCertKey value.
 * @return a RestTokenTransformValidatorParameters instance with a X509Certificate[] generic type.
 */
private RestTokenTransformValidatorParameters<X509Certificate[]> buildX509CertTokenTransformValidatorParameters(Context context) throws TokenMarshalException {
  X509Certificate[] certificates;
  if (!"String_Node_Str".equals(offloadedTlsClientCertKey)) {
    String clientIpAddress=ClientUtils.getClientIPAddress(context);
    if (!tlsOffloadEngineHosts.contains(clientIpAddress) && !tlsOffloadEngineHosts.contains(ANY_HOST)) {
      logger.error("String_Node_Str" + "String_Node_Str" + offloadedTlsClientCertKey + "String_Node_Str"+ "String_Node_Str"+ clientIpAddress+ "String_Node_Str"+ tlsOffloadEngineHosts);
      throw new TokenMarshalException(ResourceException.BAD_REQUEST,"String_Node_Str" + "String_Node_Str" + "String_Node_Str");
    }
    certificates=pullClientCertFromHeader(context.asContext(HttpContext.class));
  }
 else {
    certificates=pullClientCertFromRequestAttribute(context.asContext(ClientContext.class));
  }
  if (!ArrayUtils.isEmpty(certificates)) {
    return marshalX509CertIntoTokenValidatorParameters(certificates);
  }
 else {
    if ("String_Node_Str".equals(offloadedTlsClientCertKey)) {
      throw new TokenMarshalException(ResourceException.BAD_REQUEST,"String_Node_Str" + "String_Node_Str" + "String_Node_Str"+ "String_Node_Str");
    }
 else {
      throw new TokenMarshalException(ResourceException.BAD_REQUEST,"String_Node_Str" + "String_Node_Str" + offloadedTlsClientCertKey + "String_Node_Str"+ "String_Node_Str");
    }
  }
}