Program: 51144
Project: 51144
Buggy source:
/** 
 * Verifies the RSA-SHA1 signature of OAuth request elements.
 * @param elements OAuth elements signature is to be verified against.
 * @param secrets the secrets object containing the public key for verifying the signature.
 * @param signature base64-encoded OAuth signature to be verified.
 * @throws InvalidSecretException if the supplied secret is not valid.
 */
public boolean verify(String elements,OAuthSecrets secrets,String signature) throws InvalidSecretException {
  Signature sig;
  try {
    sig=Signature.getInstance(SIGNATURE_ALGORITHM);
  }
 catch (  NoSuchAlgorithmException nsae) {
    throw new IllegalStateException(nsae);
  }
  RSAPublicKey rsaPubKey=null;
  String tmpkey=secrets.getConsumerSecret();
  if (tmpkey.startsWith(BEGIN_CERT)) {
    try {
      Certificate cert=null;
      ByteArrayInputStream bais=new ByteArrayInputStream(tmpkey.getBytes());
      BufferedInputStream bis=new BufferedInputStream(bais);
      CertificateFactory certfac=CertificateFactory.getInstance("String_Node_Str");
      while (bis.available() > 0) {
        cert=certfac.generateCertificate(bis);
      }
      rsaPubKey=(RSAPublicKey)cert.getPublicKey();
    }
 catch (    IOException ex) {
      Logger.getLogger(RSA_SHA1.class.getName()).log(Level.SEVERE,null,ex);
    }
catch (    CertificateException ex) {
      Logger.getLogger(RSA_SHA1.class.getName()).log(Level.SEVERE,null,ex);
    }
  }
  byte[] decodedSignature;
  try {
    decodedSignature=Base64.decode(UriComponent.decode(signature,UriComponent.Type.UNRESERVED));
  }
 catch (  IOException ioe) {
    return false;
  }
  try {
    sig.initVerify(rsaPubKey);
  }
 catch (  InvalidKeyException ike) {
    throw new IllegalStateException(ike);
  }
  try {
    sig.update(elements.getBytes());
  }
 catch (  SignatureException se) {
    throw new IllegalStateException(se);
  }
  try {
    return sig.verify(decodedSignature);
  }
 catch (  SignatureException se) {
    throw new IllegalStateException(se);
  }
}

Fixed version (ground truth):
/** 
 * Verifies the RSA-SHA1 signature of OAuth request elements.
 * @param elements OAuth elements signature is to be verified against.
 * @param secrets the secrets object containing the public key for verifying the signature.
 * @param signature base64-encoded OAuth signature to be verified.
 * @throws InvalidSecretException if the supplied secret is not valid.
 */
@Override public boolean verify(String elements,OAuthSecrets secrets,String signature) throws InvalidSecretException {
  Signature sig;
  try {
    sig=Signature.getInstance(SIGNATURE_ALGORITHM);
  }
 catch (  NoSuchAlgorithmException nsae) {
    throw new IllegalStateException(nsae);
  }
  RSAPublicKey rsaPubKey=null;
  String tmpkey=secrets.getConsumerSecret();
  if (tmpkey.startsWith(BEGIN_CERT)) {
    try {
      Certificate cert=null;
      ByteArrayInputStream bais=new ByteArrayInputStream(tmpkey.getBytes());
      BufferedInputStream bis=new BufferedInputStream(bais);
      CertificateFactory certfac=CertificateFactory.getInstance("String_Node_Str");
      while (bis.available() > 0) {
        cert=certfac.generateCertificate(bis);
      }
      rsaPubKey=(RSAPublicKey)cert.getPublicKey();
    }
 catch (    IOException ex) {
      Logger.getLogger(RSA_SHA1.class.getName()).log(Level.SEVERE,null,ex);
    }
catch (    CertificateException ex) {
      Logger.getLogger(RSA_SHA1.class.getName()).log(Level.SEVERE,null,ex);
    }
  }
  byte[] decodedSignature;
  try {
    decodedSignature=Base64.decode(signature);
  }
 catch (  IOException ioe) {
    return false;
  }
  try {
    sig.initVerify(rsaPubKey);
  }
 catch (  InvalidKeyException ike) {
    throw new IllegalStateException(ike);
  }
  try {
    sig.update(elements.getBytes());
  }
 catch (  SignatureException se) {
    throw new IllegalStateException(se);
  }
  try {
    return sig.verify(decodedSignature);
  }
 catch (  SignatureException se) {
    throw new IllegalStateException(se);
  }
}