Program: 28517
Project: 28517
Buggy source:
/** 
 * <p> This is where the validation happens...</p>
 */
@Override public AuthStatus validateRequest(MessageInfo messageInfo,Subject clientSubject,Subject serviceSubject) throws AuthException {
  HttpServletRequest request=(HttpServletRequest)messageInfo.getRequestMessage();
  HttpServletResponse response=(HttpServletResponse)messageInfo.getResponseMessage();
  if (!isMandatory(messageInfo) && !request.getRequestURI().endsWith("String_Node_Str")) {
    return AuthStatus.SUCCESS;
  }
  HttpSession session=request.getSession(true);
  if (session != null) {
    Subject savedClientSubject=(Subject)session.getValue(SAVED_SUBJECT);
    if (savedClientSubject != null) {
      clientSubject.getPrincipals().addAll(savedClientSubject.getPrincipals());
      clientSubject.getPublicCredentials().addAll(savedClientSubject.getPublicCredentials());
      clientSubject.getPrivateCredentials().addAll(savedClientSubject.getPrivateCredentials());
      return AuthStatus.SUCCESS;
    }
  }
  if (session.getValue(REST_SERVER_NAME) == null) {
    URL url=null;
    try {
      url=new URL(restURL);
    }
 catch (    MalformedURLException ex) {
      throw new IllegalArgumentException("String_Node_Str" + restURL + "String_Node_Str",ex);
    }
    session.putValue(REST_SERVER_NAME,url.getHost());
    session.putValue(REST_SERVER_PORT,url.getPort());
  }
  String username=request.getParameter("String_Node_Str");
  String password=request.getParameter("String_Node_Str");
  if ((username == null) || (password == null) || !request.getMethod().equalsIgnoreCase("String_Node_Str")) {
    String origPath=request.getRequestURI();
    String qs=request.getQueryString();
    if ((qs != null) && (!qs.isEmpty())) {
      origPath+="String_Node_Str" + qs;
    }
    session.setAttribute(ORIG_REQUEST_PATH,origPath);
    RequestDispatcher rd=request.getRequestDispatcher(loginPage);
    try {
      rd.forward(request,response);
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    return AuthStatus.SEND_CONTINUE;
  }
  Client client2=RestUtil.initialize(ClientBuilder.newBuilder()).build();
  WebTarget target=client2.target(restURL);
  target.register(new HttpBasicAuthFilter(username,password));
  MultivaluedMap payLoad=new MultivaluedHashMap();
  payLoad.putSingle("String_Node_Str",request.getRemoteHost());
  Response resp=target.request(RESPONSE_TYPE).post(Entity.entity(payLoad,MediaType.APPLICATION_FORM_URLENCODED),Response.class);
  RestResponse restResp=RestResponse.getRestResponse(resp);
  if (restResp.isSuccess()) {
    CallerPrincipalCallback cpCallback=new CallerPrincipalCallback(clientSubject,username);
    try {
      handler.handle(new Callback[]{cpCallback});
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    request.changeSessionId();
    if (session != null) {
      Object obj=restResp.getResponse().get("String_Node_Str");
      Map extraProperties=null;
      if ((obj != null) && (obj instanceof Map)) {
        obj=((Map)obj).get("String_Node_Str");
        if ((obj != null) && (obj instanceof Map)) {
          extraProperties=(Map)obj;
        }
      }
      if (extraProperties != null) {
        session.putValue(REST_TOKEN,extraProperties.get("String_Node_Str"));
      }
      session.putValue(SAVED_SUBJECT,clientSubject);
      session.putValue(USER_NAME,username);
    }
    try {
      String origRequest=(String)session.getAttribute(ORIG_REQUEST_PATH);
      if ((origRequest == null) || "String_Node_Str".equals(origRequest)) {
        origRequest="String_Node_Str";
      }
      logger.log(Level.INFO,"String_Node_Str",origRequest);
      response.sendRedirect(response.encodeRedirectURL(origRequest));
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    return AuthStatus.SEND_CONTINUE;
  }
 else {
    int status=restResp.getResponseCode();
    if (status == 403) {
      request.setAttribute("String_Node_Str",GuiUtil.getMessage("String_Node_Str"));
      request.setAttribute("String_Node_Str",GuiUtil.getMessage("String_Node_Str"));
    }
    RequestDispatcher rd=request.getRequestDispatcher(this.loginErrorPage);
    try {
      rd.forward(request,response);
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    return AuthStatus.SEND_FAILURE;
  }
}

Fixed version (ground truth):
/** 
 * <p> This is where the validation happens...</p>
 */
@Override public AuthStatus validateRequest(MessageInfo messageInfo,Subject clientSubject,Subject serviceSubject) throws AuthException {
  HttpServletRequest request=(HttpServletRequest)messageInfo.getRequestMessage();
  HttpServletResponse response=(HttpServletResponse)messageInfo.getResponseMessage();
  if (!isMandatory(messageInfo) && !request.getRequestURI().endsWith("String_Node_Str")) {
    return AuthStatus.SUCCESS;
  }
  HttpSession session=request.getSession(true);
  if (session != null) {
    Subject savedClientSubject=(Subject)session.getValue(SAVED_SUBJECT);
    if (savedClientSubject != null) {
      clientSubject.getPrincipals().addAll(savedClientSubject.getPrincipals());
      clientSubject.getPublicCredentials().addAll(savedClientSubject.getPublicCredentials());
      clientSubject.getPrivateCredentials().addAll(savedClientSubject.getPrivateCredentials());
      return AuthStatus.SUCCESS;
    }
  }
  if ((session != null) && (session.getValue(REST_SERVER_NAME) == null)) {
    URL url=null;
    try {
      url=new URL(restURL);
    }
 catch (    MalformedURLException ex) {
      throw new IllegalArgumentException("String_Node_Str" + restURL + "String_Node_Str",ex);
    }
    session.putValue(REST_SERVER_NAME,url.getHost());
    session.putValue(REST_SERVER_PORT,url.getPort());
  }
  String username=request.getParameter("String_Node_Str");
  String password=request.getParameter("String_Node_Str");
  if ((username == null) || (password == null) || !request.getMethod().equalsIgnoreCase("String_Node_Str")) {
    String origPath=request.getRequestURI();
    String qs=request.getQueryString();
    if ((qs != null) && (!qs.isEmpty())) {
      origPath+="String_Node_Str" + qs;
    }
    session.setAttribute(ORIG_REQUEST_PATH,origPath);
    RequestDispatcher rd=request.getRequestDispatcher(loginPage);
    try {
      rd.forward(request,response);
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    return AuthStatus.SEND_CONTINUE;
  }
  Client client2=RestUtil.initialize(ClientBuilder.newBuilder()).build();
  WebTarget target=client2.target(restURL);
  target.register(new HttpBasicAuthFilter(username,password));
  MultivaluedMap payLoad=new MultivaluedHashMap();
  payLoad.putSingle("String_Node_Str",request.getRemoteHost());
  Response resp=target.request(RESPONSE_TYPE).post(Entity.entity(payLoad,MediaType.APPLICATION_FORM_URLENCODED),Response.class);
  RestResponse restResp=RestResponse.getRestResponse(resp);
  if (restResp.isSuccess()) {
    CallerPrincipalCallback cpCallback=new CallerPrincipalCallback(clientSubject,username);
    try {
      handler.handle(new Callback[]{cpCallback});
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    request.changeSessionId();
    if (session != null) {
      Object obj=restResp.getResponse().get("String_Node_Str");
      Map extraProperties=null;
      if ((obj != null) && (obj instanceof Map)) {
        obj=((Map)obj).get("String_Node_Str");
        if ((obj != null) && (obj instanceof Map)) {
          extraProperties=(Map)obj;
        }
      }
      if (extraProperties != null) {
        session.putValue(REST_TOKEN,extraProperties.get("String_Node_Str"));
      }
      session.putValue(SAVED_SUBJECT,clientSubject);
      session.putValue(USER_NAME,username);
    }
    try {
      String origRequest=(String)session.getAttribute(ORIG_REQUEST_PATH);
      if ((origRequest == null) || "String_Node_Str".equals(origRequest)) {
        origRequest="String_Node_Str";
      }
      logger.log(Level.INFO,"String_Node_Str",origRequest);
      response.sendRedirect(response.encodeRedirectURL(origRequest));
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    return AuthStatus.SEND_CONTINUE;
  }
 else {
    int status=restResp.getResponseCode();
    if (status == 403) {
      request.setAttribute("String_Node_Str",GuiUtil.getMessage("String_Node_Str"));
      request.setAttribute("String_Node_Str",GuiUtil.getMessage("String_Node_Str"));
    }
    RequestDispatcher rd=request.getRequestDispatcher(this.loginErrorPage);
    try {
      rd.forward(request,response);
    }
 catch (    Exception ex) {
      AuthException ae=new AuthException();
      ae.initCause(ex);
      throw ae;
    }
    return AuthStatus.SEND_FAILURE;
  }
}