Program: 31298
Project: 31298
Buggy source:
/** 
 * Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging specific session ID, and the current date/time. It will only log the message if the current logging level is enabled, otherwise it will discard the message.
 * @param level defines the set of recognized logging levels (TRACE, INFO, DEBUG, WARNING, ERROR, FATAL)
 * @param type the type of the event (SECURITY SUCCESS, SECURITY FAILURE, EVENT SUCCESS, EVENT FAILURE)
 * @param message the message to be logged
 * @param throwable the {@code Throwable} from which to generate an exception stack trace.
 */
private void log(Level level,EventType type,String message,Throwable throwable){
  if (!isEnabledFor(level)) {
    return;
  }
  if (message == null) {
    message="String_Node_Str";
  }
  String clean=message.replace('\n','_').replace('\r','_');
  if (ESAPI.securityConfiguration().getLogEncodingRequired()) {
    clean=ESAPI.encoder().encodeForHTML(message);
    if (!message.equals(clean)) {
      clean+="String_Node_Str";
    }
  }
  StringBuilder appInfo=new StringBuilder();
  if (ESAPI.currentRequest() != null && logServerIP) {
    appInfo.append(ESAPI.currentRequest().getLocalAddr()).append("String_Node_Str").append(ESAPI.currentRequest().getLocalPort());
  }
  if (logAppName) {
    appInfo.append("String_Node_Str").append(applicationName);
  }
  appInfo.append("String_Node_Str").append(getName());
  String typeInfo="String_Node_Str";
  if (type != null) {
    typeInfo+=type + "String_Node_Str";
  }
  log(level,"String_Node_Str" + typeInfo + getUserInfo()+ "String_Node_Str"+ appInfo+ "String_Node_Str"+ clean,throwable);
}

Fixed version (ground truth):
/** 
 * Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging specific session ID, and the current date/time. It will only log the message if the current logging level is enabled, otherwise it will discard the message.
 * @param level defines the set of recognized logging levels (TRACE, INFO, DEBUG, WARNING, ERROR, FATAL)
 * @param type the type of the event (SECURITY SUCCESS, SECURITY FAILURE, EVENT SUCCESS, EVENT FAILURE)
 * @param message the message to be logged
 * @param throwable the {@code Throwable} from which to generate an exception stack trace.
 */
private void log(Level level,EventType type,String message,Throwable throwable){
  if (!isEnabledFor(level)) {
    return;
  }
  if (message == null) {
    message="String_Node_Str";
  }
  String clean=message.replace('\n','_').replace('\r','_');
  if (ESAPI.securityConfiguration().getLogEncodingRequired()) {
    clean=ESAPI.encoder().encodeForHTML(message);
    if (!message.equals(clean)) {
      clean+="String_Node_Str";
    }
  }
  StringBuilder appInfo=new StringBuilder();
  if (ESAPI.currentRequest() != null && logServerIP) {
    appInfo.append(ESAPI.currentRequest().getLocalAddr()).append("String_Node_Str").append(ESAPI.currentRequest().getLocalPort());
  }
  if (logAppName) {
    appInfo.append("String_Node_Str").append(applicationName);
  }
  appInfo.append("String_Node_Str").append(getName());
  String typeInfo="String_Node_Str";
  if (type != null) {
    typeInfo+=type + "String_Node_Str";
  }
  log(Log4JLogger.class.getName(),level,"String_Node_Str" + typeInfo + getUserInfo()+ "String_Node_Str"+ appInfo+ "String_Node_Str"+ clean,throwable);
}