Program: 45367
Project: 45367
Buggy source:
/** 
 * See if this user has a persisent userID cookie and set up preferences. Note: This method is only called if the user does not have a current session. The username and password are used for authentication here: user=null, password=null - No change user=user, password=null - Sign-on (login level) user=user, password=pass - Sign-on (authenticated level) user=blank,password=null - Sign-off (anonymous user) username can be user(name) or userid. password can be password or auth(entication) token.
 */
public App findApplication(HttpServletRequest req,HttpServletResponse res){
  ServletApplication application=null;
  String strDatatype=BaseHttpTask.getParam(req,DBParams.DATATYPE,null);
  if (strDatatype != null) {
    return this.getNonUserApplication();
  }
  HttpSession session=req.getSession();
  String strUserNameOrID=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.USER_NAME),false,null);
  if (strUserNameOrID == null)   strUserNameOrID=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.USER_ID),false,null);
  if (!session.isNew()) {
    application=(ServletApplication)session.getAttribute(DBParams.APPLICATION);
    if (application != null) {
      if (strUserNameOrID != null) {
        boolean bNewUser=false;
        if ((strUserNameOrID.length() == 0) && (BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null) == null))         bNewUser=true;
        if (strUserNameOrID.length() > 0) {
          if ((BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null) != null) && (BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null).length() > 0))           bNewUser=true;
          if ((BaseHttpTask.cleanParam(req.getParameterValues(DBParams.AUTH_TOKEN),false,null) != null) && (BaseHttpTask.cleanParam(req.getParameterValues(DBParams.AUTH_TOKEN),false,null).length() > 0))           bNewUser=true;
          if ((!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_NAME))) && (!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_ID))))           bNewUser=true;
        }
        if (bNewUser) {
          session.removeAttribute(DBParams.APPLICATION);
          application=null;
        }
      }
      if (application != null) {
        application=this.changeCookie(application,req,res);
        application.addTask(this,null);
        return application;
      }
    }
  }
  Utility.getLogger().info("String_Node_Str");
  if (strUserNameOrID != null) {
    Map<String,Object> properties=new Hashtable<String,Object>();
    Map<String,Object> appProperties=this.getApplicationProperties(false);
    if (appProperties != null)     properties.putAll(appProperties);
    this.addDatabaseProperties(properties);
    properties.remove(Params.USER_ID);
    properties.put(Params.USER_NAME,strUserNameOrID);
    application=new ServletApplication(null,properties,null);
    if (this.getApplication() == null) {
      application.addTask(this,null);
      this.setApplication(application);
    }
    int iLoginError=DBConstants.NORMAL_RETURN;
    if ((strUserNameOrID.length() > 0) && (!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_ID))) && (!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_NAME))))     iLoginError=DBConstants.ERROR_RETURN;
 else {
      String strPassword=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null);
      if ((strPassword != null) && (strPassword.length() > 0)) {
        try {
          byte[] bytes=strPassword.getBytes(Base64.DEFAULT_ENCODING);
          bytes=Base64.encodeSHA(bytes);
          char[] chars=Base64.encode(bytes);
          strPassword=new String(chars);
        }
 catch (        NoSuchAlgorithmException ex) {
          ex.printStackTrace();
          strPassword=null;
        }
catch (        UnsupportedEncodingException ex) {
          ex.printStackTrace();
          strPassword=null;
        }
      }
      if ((strPassword == null) || (strPassword.length() == 0)) {
        strPassword=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.AUTH_TOKEN),false,null);
        strPassword=application.authenticateToken(strPassword);
      }
      if ((strPassword != null) && (strPassword.length() > 0)) {
        String strDomain=Utility.getDomainFromURL(BaseHttpTask.getParam(req,DBParams.URL),null);
        iLoginError=application.login(this,strUserNameOrID,strPassword,strDomain);
      }
    }
    if (iLoginError != DBConstants.NORMAL_RETURN) {
      application.login(this,null,null,null);
      application.setProperty(Params.SECURITY_LEVEL,Integer.toString(Constants.LOGIN_USER));
      if (iLoginError == DBConstants.ERROR_RETURN)       application.setProperty(Params.SECURITY_MAP,Application.CREATE_USER_REQUIRED);
 else       application.setProperty(Params.SECURITY_MAP,Application.LOGIN_REQUIRED);
    }
  }
  application=this.changeCookie(application,req,res);
  session.setAttribute(DBParams.APPLICATION,application);
  application.addTask(this,null);
  return application;
}

Fixed version (ground truth):
/** 
 * See if this user has a persisent userID cookie and set up preferences. Note: This method is only called if the user does not have a current session. The username and password are used for authentication here: user=null, password=null - No change user=user, password=null - Sign-on (login level) user=user, password=pass - Sign-on (authenticated level) user=blank,password=null - Sign-off (anonymous user) username can be user(name) or userid. password can be password or auth(entication) token.
 */
public App findApplication(HttpServletRequest req,HttpServletResponse res){
  ServletApplication application=null;
  String strDatatype=BaseHttpTask.getParam(req,DBParams.DATATYPE,null);
  if (strDatatype != null) {
    return this.getNonUserApplication();
  }
  HttpSession session=req.getSession();
  String strUserNameOrID=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.USER_NAME),false,null);
  if (strUserNameOrID == null)   strUserNameOrID=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.USER_ID),false,null);
  if (!session.isNew()) {
    application=(ServletApplication)session.getAttribute(DBParams.APPLICATION);
    if (application != null) {
      if (strUserNameOrID != null) {
        boolean bNewUser=false;
        if ((strUserNameOrID.length() == 0) && (BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null) == null))         bNewUser=true;
        if (strUserNameOrID.length() > 0) {
          if ((BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null) != null) && (BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null).length() > 0))           bNewUser=true;
          if ((BaseHttpTask.cleanParam(req.getParameterValues(DBParams.AUTH_TOKEN),false,null) != null) && (BaseHttpTask.cleanParam(req.getParameterValues(DBParams.AUTH_TOKEN),false,null).length() > 0))           bNewUser=true;
          if ((!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_NAME))) && (!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_ID))))           bNewUser=true;
        }
        if (bNewUser) {
          session.removeAttribute(DBParams.APPLICATION);
          application=null;
        }
      }
      if (application != null) {
        application=this.changeCookie(application,req,res);
        application.addTask(this,null);
        this.setApplication(application);
        return application;
      }
    }
  }
  Utility.getLogger().info("String_Node_Str");
  if (strUserNameOrID != null) {
    Map<String,Object> properties=new Hashtable<String,Object>();
    Map<String,Object> appProperties=this.getApplicationProperties(false);
    if (appProperties != null)     properties.putAll(appProperties);
    this.addDatabaseProperties(properties);
    properties.remove(Params.USER_ID);
    properties.put(Params.USER_NAME,strUserNameOrID);
    application=new ServletApplication(null,properties,null);
    if (this.getApplication() == null) {
      application.addTask(this,null);
      this.setApplication(application);
    }
    int iLoginError=DBConstants.NORMAL_RETURN;
    if ((strUserNameOrID.length() > 0) && (!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_ID))) && (!strUserNameOrID.equalsIgnoreCase(application.getProperty(DBParams.USER_NAME))))     iLoginError=DBConstants.ERROR_RETURN;
 else {
      String strPassword=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.PASSWORD),false,null);
      if ((strPassword != null) && (strPassword.length() > 0)) {
        try {
          byte[] bytes=strPassword.getBytes(Base64.DEFAULT_ENCODING);
          bytes=Base64.encodeSHA(bytes);
          char[] chars=Base64.encode(bytes);
          strPassword=new String(chars);
        }
 catch (        NoSuchAlgorithmException ex) {
          ex.printStackTrace();
          strPassword=null;
        }
catch (        UnsupportedEncodingException ex) {
          ex.printStackTrace();
          strPassword=null;
        }
      }
      if ((strPassword == null) || (strPassword.length() == 0)) {
        strPassword=BaseHttpTask.cleanParam(req.getParameterValues(DBParams.AUTH_TOKEN),false,null);
        strPassword=application.authenticateToken(strPassword);
      }
      if ((strPassword != null) && (strPassword.length() > 0)) {
        String strDomain=Utility.getDomainFromURL(BaseHttpTask.getParam(req,DBParams.URL),null);
        iLoginError=application.login(this,strUserNameOrID,strPassword,strDomain);
      }
    }
    if (iLoginError != DBConstants.NORMAL_RETURN) {
      application.login(this,null,null,null);
      application.setProperty(Params.SECURITY_LEVEL,Integer.toString(Constants.LOGIN_USER));
      if (iLoginError == DBConstants.ERROR_RETURN)       application.setProperty(Params.SECURITY_MAP,Application.CREATE_USER_REQUIRED);
 else       application.setProperty(Params.SECURITY_MAP,Application.LOGIN_REQUIRED);
    }
  }
  application=this.changeCookie(application,req,res);
  session.setAttribute(DBParams.APPLICATION,application);
  application.addTask(this,null);
  this.setApplication(application);
  return application;
}