Program: 31385
Project: 31385
Buggy source:
/** 
 * Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log  injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging specific session ID, and the current date/time. It will only log the message if the current logging level is enabled, otherwise it will  discard the message. 
 * @param level the severity level of the security event
 * @param type the type of the event (SECURITY, FUNCTIONALITY, etc.)
 * @param success whether this was a failed or successful event
 * @param message the message
 * @param throwable the throwable
 */
private void log(Level level,EventType type,String message,Throwable throwable){
  if (!jlogger.isEnabledFor(level))   return;
  String sid=null;
  HttpServletRequest request=ESAPI.httpUtilities().getCurrentRequest();
  if (request != null) {
    HttpSession session=request.getSession(false);
    if (session != null) {
      sid=(String)session.getAttribute("String_Node_Str");
      if (sid == null) {
        sid="String_Node_Str" + ESAPI.randomizer().getRandomInteger(0,1000000);
        session.setAttribute("String_Node_Str",sid);
      }
    }
  }
  if (message == null) {
    message="String_Node_Str";
  }
  String clean=message.replace('\n','_').replace('\r','_');
  if (((DefaultSecurityConfiguration)ESAPI.securityConfiguration()).getLogEncodingRequired()) {
    clean=ESAPI.encoder().encodeForHTML(message);
    if (!message.equals(clean)) {
      clean+="String_Node_Str";
    }
  }
  User user=ESAPI.authenticator().getCurrentUser();
  String userInfo="String_Node_Str";
  if (user != null && type != null) {
    userInfo=user.getAccountName() + "String_Node_Str" + sid+ "String_Node_Str"+ user.getLastHostAddress();
  }
  StringBuilder appInfo=new StringBuilder();
  if (ESAPI.currentRequest() != null && logServerIP) {
    appInfo.append(ESAPI.currentRequest().getLocalAddr() + "String_Node_Str" + ESAPI.currentRequest().getLocalPort());
  }
  if (logAppName) {
    appInfo.append("String_Node_Str" + applicationName);
  }
  appInfo.append("String_Node_Str" + moduleName);
  jlogger.log(level,"String_Node_Str" + userInfo + "String_Node_Str"+ appInfo+ "String_Node_Str"+ clean,throwable);
}

Fixed version (ground truth):
/** 
 * Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log  injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging specific session ID, and the current date/time. It will only log the message if the current logging level is enabled, otherwise it will  discard the message. 
 * @param level the severity level of the security event
 * @param type the type of the event (SECURITY, FUNCTIONALITY, etc.)
 * @param success whether this was a failed or successful event
 * @param message the message
 * @param throwable the throwable
 */
private void log(Level level,EventType type,String message,Throwable throwable){
  if (!jlogger.isEnabledFor(level))   return;
  String sid=null;
  HttpServletRequest request=ESAPI.httpUtilities().getCurrentRequest();
  if (request != null) {
    HttpSession session=request.getSession(false);
    if (session != null) {
      sid=(String)session.getAttribute("String_Node_Str");
      if (sid == null) {
        sid="String_Node_Str" + ESAPI.randomizer().getRandomInteger(0,1000000);
        session.setAttribute("String_Node_Str",sid);
      }
    }
  }
  if (message == null) {
    message="String_Node_Str";
  }
  String clean=message.replace('\n','_').replace('\r','_');
  if (ESAPI.securityConfiguration().getLogEncodingRequired()) {
    clean=ESAPI.encoder().encodeForHTML(message);
    if (!message.equals(clean)) {
      clean+="String_Node_Str";
    }
  }
  User user=ESAPI.authenticator().getCurrentUser();
  String userInfo="String_Node_Str";
  if (user != null && type != null) {
    userInfo=user.getAccountName() + "String_Node_Str" + sid+ "String_Node_Str"+ user.getLastHostAddress();
  }
  StringBuilder appInfo=new StringBuilder();
  if (ESAPI.currentRequest() != null && logServerIP) {
    appInfo.append(ESAPI.currentRequest().getLocalAddr() + "String_Node_Str" + ESAPI.currentRequest().getLocalPort());
  }
  if (logAppName) {
    appInfo.append("String_Node_Str" + applicationName);
  }
  appInfo.append("String_Node_Str" + moduleName);
  jlogger.log(level,"String_Node_Str" + userInfo + "String_Node_Str"+ appInfo+ "String_Node_Str"+ clean,throwable);
}