Program: 34559
Project: 34559
Buggy source:
/** 
 * @param webRequest
 * @return
 */
private WebReply handleJaspi(Subject receivedSubject,String uriName,WebRequest webRequest,WebSecurityContext webSecurityContext) throws SecurityViolationException, IOException {
  performPrecludedAccessTests(webRequest,webSecurityContext,uriName);
  WebReply webReply=unprotectedSpecialURI(webRequest,uriName,webRequest.getHttpServletRequest().getMethod());
  if (webReply == null) {
    String authMech=webAppSecConfig.getOverrideHttpAuthenticationMechanism();
    AuthenticationResult authResult=null;
    if (authMech != null && authMech.equals("String_Node_Str")) {
      authResult=authenticateRequest(webRequest);
    }
    if (authResult != null && authResult.getStatus() != AuthResult.SUCCESS) {
      authResult=providerAuthenticatorProxy.handleJaspi(webRequest,null);
      authResult.setAuditCredType(AuditEvent.CRED_TYPE_JASPIC);
      if (receivedSubject != null && receivedSubject.getPrincipals() != null) {
        authResult.setAuditCredValue(receivedSubject.getPrincipals().iterator().next().getName());
      }
    }
    if (authResult.getStatus() == AuthResult.RETURN) {
      String reason=authResult.getReason();
      int statusCode=webRequest.getHttpServletResponse().getStatus();
      if (reason != null && reason.contains("String_Node_Str")) {
        if (unprotectedResource(webRequest) == PERMIT_REPLY) {
          AuthenticationResult permitResult=new AuthenticationResult(AuthResult.SUCCESS,(Subject)null,AuditEvent.CRED_TYPE_JASPIC,null,AuditEvent.OUTCOME_SUCCESS);
          Audit.audit(Audit.EventID.SECURITY_AUTHN_01,webRequest,authResult,Integer.valueOf(statusCode));
          Audit.audit(Audit.EventID.SECURITY_AUTHZ_01,webRequest,permitResult,uriName,Integer.valueOf(HttpServletResponse.SC_OK));
          return PERMIT_REPLY;
        }
 else         if (statusCode == HttpServletResponse.SC_OK) {
          statusCode=HttpServletResponse.SC_UNAUTHORIZED;
          webRequest.getHttpServletResponse().setStatus(statusCode);
        }
      }
      webReply=new ReturnReply(statusCode,reason);
      Audit.audit(Audit.EventID.SECURITY_AUTHN_01,webRequest,authResult,Integer.valueOf(webReply.getStatusCode()));
      SecurityViolationException secVE=convertWebSecurityException(new WebSecurityCollaboratorException(webReply.message,webReply,webSecurityContext));
      throw secVE;
    }
 else     if (authResult.getStatus() != AuthResult.CONTINUE) {
      webReply=determineWebReply(receivedSubject,uriName,webRequest,authResult);
    }
  }
  return webReply;
}

Fixed version (ground truth):
/** 
 * @param webRequest
 * @return
 */
private WebReply handleJaspi(Subject receivedSubject,String uriName,WebRequest webRequest,WebSecurityContext webSecurityContext) throws SecurityViolationException, IOException {
  performPrecludedAccessTests(webRequest,webSecurityContext,uriName);
  WebReply webReply=unprotectedSpecialURI(webRequest,uriName,webRequest.getHttpServletRequest().getMethod());
  if (webReply == null) {
    String authMech=webAppSecConfig.getOverrideHttpAuthenticationMechanism();
    AuthenticationResult authResult=null;
    if (authMech != null && authMech.equals("String_Node_Str")) {
      authResult=authenticateRequest(webRequest);
    }
    if (authResult == null || authResult.getStatus() != AuthResult.SUCCESS) {
      authResult=providerAuthenticatorProxy.handleJaspi(webRequest,null);
      authResult.setAuditCredType(AuditEvent.CRED_TYPE_JASPIC);
      if (receivedSubject != null && receivedSubject.getPrincipals() != null) {
        authResult.setAuditCredValue(receivedSubject.getPrincipals().iterator().next().getName());
      }
    }
    if (authResult.getStatus() == AuthResult.RETURN) {
      String reason=authResult.getReason();
      int statusCode=webRequest.getHttpServletResponse().getStatus();
      if (reason != null && reason.contains("String_Node_Str")) {
        if (unprotectedResource(webRequest) == PERMIT_REPLY) {
          AuthenticationResult permitResult=new AuthenticationResult(AuthResult.SUCCESS,(Subject)null,AuditEvent.CRED_TYPE_JASPIC,null,AuditEvent.OUTCOME_SUCCESS);
          Audit.audit(Audit.EventID.SECURITY_AUTHN_01,webRequest,authResult,Integer.valueOf(statusCode));
          Audit.audit(Audit.EventID.SECURITY_AUTHZ_01,webRequest,permitResult,uriName,Integer.valueOf(HttpServletResponse.SC_OK));
          return PERMIT_REPLY;
        }
 else         if (statusCode == HttpServletResponse.SC_OK) {
          statusCode=HttpServletResponse.SC_UNAUTHORIZED;
          webRequest.getHttpServletResponse().setStatus(statusCode);
        }
      }
      webReply=new ReturnReply(statusCode,reason);
      Audit.audit(Audit.EventID.SECURITY_AUTHN_01,webRequest,authResult,Integer.valueOf(webReply.getStatusCode()));
      SecurityViolationException secVE=convertWebSecurityException(new WebSecurityCollaboratorException(webReply.message,webReply,webSecurityContext));
      throw secVE;
    }
 else     if (authResult.getStatus() != AuthResult.CONTINUE) {
      webReply=determineWebReply(receivedSubject,uriName,webRequest,authResult);
    }
  }
  return webReply;
}