Program: 53349
Project: 53349
Buggy source:
@Override public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  String said="String_Node_Str";
  String username="String_Node_Str";
  String password="String_Node_Str";
  Tenant tenant=null;
  HttpServletRequest req=(HttpServletRequest)request;
  String url=req.getRequestURL().toString();
  logger.info("String_Node_Str" + url);
  int index=url.indexOf("String_Node_Str");
  int index_push=url.indexOf("String_Node_Str");
  if (((index < 0) && (index_push < 0)) || ((url.length() <= (index + API_PREFIX_LENGTH + 1)) && (url.length() <= (index + PUSH_PREFIX_LENGTH + 1)))) {
    logger.error("String_Node_Str" + url);
    return;
  }
  if ((index > 0)) {
    index+=API_PREFIX_LENGTH;
    said=url.substring(index,url.indexOf("String_Node_Str",index));
  }
 else   if ((index_push > 0)) {
    index_push+=PUSH_PREFIX_LENGTH;
    said=url.substring(index_push,url.indexOf("String_Node_Str",index_push));
  }
 else {
    logger.error("String_Node_Str" + url);
    return;
  }
  try {
    tenant=tenantManager.getByAccountName(said);
    String auth=req.getHeader("String_Node_Str");
    if (auth == null) {
      HttpSession session=req.getSession();
      SecurityContext secContext=(SecurityContext)session.getAttribute("String_Node_Str");
      if (secContext != null) {
        username=secContext.getAuthentication().getName();
        Collection<GrantedAuthority> authorities=secContext.getAuthentication().getAuthorities();
        boolean pass=false;
        for (Iterator<GrantedAuthority> iterator=authorities.iterator(); iterator.hasNext(); ) {
          GrantedAuthority grantedAuthority=(GrantedAuthority)iterator.next();
          if (grantedAuthority.getAuthority().equals(Role.OWNER.toString()) || grantedAuthority.getAuthority().equals(Role.ADMIN.toString())) {
            pass=true;
            logger.debug(username + "String_Node_Str" + grantedAuthority.getAuthority());
          }
        }
        User user=User.findByTenantAndByUsername(tenant,username);
        if (pass && (user != null)) {
          chain.doFilter(request,response);
          logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str");
          return;
        }
 else {
          logger.error("String_Node_Str" + url + "String_Node_Str"+ username);
          throw new AccessControlException("String_Node_Str");
        }
      }
 else {
        logger.debug("String_Node_Str" + url + "String_Node_Str"+ username);
        throw new AccessControlException("String_Node_Str");
      }
    }
 else {
      auth=auth.substring(5);
      String decoded_auth=Base64encoding.decode(auth.trim());
      int d_index=decoded_auth.indexOf("String_Node_Str");
      username=decoded_auth.substring(0,d_index);
      password=decoded_auth.substring(d_index + 1);
      if (url.endsWith("String_Node_Str" + said + "String_Node_Str"+ username)) {
        User user=User.findByTenantAndByUsername(tenant,username);
        if (user.getTenant().getId().equals(tenant.getId())) {
          chain.doFilter(request,response);
        }
 else {
          logger.error("String_Node_Str" + url + "String_Node_Str"+ username);
          throw new AccessControlException("String_Node_Str");
        }
      }
 else {
        User user=userManager.getByUsernameAndPassword(username,password);
        if ((user.getRole() == Role.GUEST) && user.getTenant().getId().equals(tenant.getId())) {
          if (url.contains("String_Node_Str" + said + "String_Node_Str")) {
            logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str"+ user.getTenant().getName());
            chain.doFilter(request,response);
          }
        }
 else         if (user.getRole() == Role.OWNER && user.getTenant().getId().equals(tenant.getId())) {
          logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str");
          chain.doFilter(request,response);
        }
 else         if (user.getRole() == Role.ADMIN) {
          logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str");
          chain.doFilter(request,response);
        }
 else {
          logger.error("String_Node_Str" + url + "String_Node_Str"+ username);
          throw new AccessControlException("String_Node_Str");
        }
      }
    }
  }
 catch (  IndexOutOfBoundsException e) {
    logger.error("String_Node_Str" + url);
  }
catch (  NoResultException e) {
    logger.error("String_Node_Str" + username);
    throw new AccessControlException("String_Node_Str");
  }
}

Fixed version (ground truth):
@Override public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException, ServletException {
  String said="String_Node_Str";
  Tenant tenant=null;
  HttpServletRequest req=(HttpServletRequest)request;
  String url=req.getRequestURL().toString();
  logger.debug("String_Node_Str" + req.getMethod() + "String_Node_Str"+ url+ "String_Node_Str");
  int apiPrefixIdx=url.indexOf(API_PREFIX);
  int pushPrefixIdx=url.indexOf(PUSH_PREFIX);
  if ((apiPrefixIdx < 0 && pushPrefixIdx < 0) || (url.length() <= (apiPrefixIdx + API_PREFIX_LENGTH + 1) && url.length() <= (apiPrefixIdx + PUSH_PREFIX_LENGTH + 1))) {
    logger.error("String_Node_Str" + url);
    return;
  }
  if (apiPrefixIdx > 0) {
    apiPrefixIdx+=API_PREFIX_LENGTH;
    said=url.substring(apiPrefixIdx,url.indexOf("String_Node_Str",apiPrefixIdx));
  }
 else   if (pushPrefixIdx > 0) {
    pushPrefixIdx+=PUSH_PREFIX_LENGTH;
    said=url.substring(pushPrefixIdx,url.indexOf("String_Node_Str",pushPrefixIdx));
  }
 else {
    logger.error("String_Node_Str" + url);
    return;
  }
  try {
    tenant=tenantManager.getByAccountName(said);
    String auth=req.getHeader("String_Node_Str");
    if (auth == null) {
      HttpSession session=req.getSession();
      SecurityContext secContext=(SecurityContext)session.getAttribute("String_Node_Str");
      if (secContext != null) {
        String username=secContext.getAuthentication().getName();
        Collection<GrantedAuthority> authorities=secContext.getAuthentication().getAuthorities();
        boolean pass=false;
        for (Iterator<GrantedAuthority> iterator=authorities.iterator(); iterator.hasNext(); ) {
          GrantedAuthority grantedAuthority=(GrantedAuthority)iterator.next();
          if (Role.OWNER.toString().equals(grantedAuthority.getAuthority()) || Role.ADMIN.toString().equals(grantedAuthority.getAuthority())) {
            pass=true;
            logger.debug(username + "String_Node_Str" + grantedAuthority.getAuthority());
          }
        }
        User user=User.findByTenantAndByUsername(tenant,username);
        if (pass && user != null) {
          chain.doFilter(request,response);
          logger.debug(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str"+ username);
          return;
        }
 else {
          throw new AccessControlException(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str"+ username);
        }
      }
 else {
        throw new AccessControlException(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str");
      }
    }
 else {
      String decodedAuth=Base64encoding.decode(auth.substring(5).trim());
      String[] credentials=decodedAuth.split("String_Node_Str");
      String username=credentials[0];
      String password=credentials[1];
      if (url.endsWith(API_PREFIX + said + "String_Node_Str"+ username)) {
        User user=User.findByTenantAndByUsername(tenant,username);
        if (user.getTenant().getId().equals(tenant.getId())) {
          chain.doFilter(request,response);
        }
 else {
          throw new AccessControlException(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str"+ username);
        }
      }
 else {
        User user=userManager.getByUsernameAndPassword(username,password);
        if (user == null) {
          throw new AccessControlException(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str"+ username+ "String_Node_Str");
        }
 else         if (Role.GUEST.equals(user.getRole()) && user.getTenant().getId().equals(tenant.getId())) {
          if (url.contains("String_Node_Str" + said + "String_Node_Str")) {
            logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str"+ user.getTenant().getName());
            chain.doFilter(request,response);
          }
        }
 else         if (Role.OWNER.equals(user.getRole()) && user.getTenant().getId().equals(tenant.getId())) {
          logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str");
          chain.doFilter(request,response);
        }
 else         if (Role.ADMIN.equals(user.getRole())) {
          logger.debug("String_Node_Str" + url + "String_Node_Str"+ username+ "String_Node_Str");
          chain.doFilter(request,response);
        }
 else {
          throw new AccessControlException(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str"+ username);
        }
      }
    }
  }
 catch (  IndexOutOfBoundsException e) {
    logger.error("String_Node_Str" + url);
  }
catch (  NoResultException e) {
    throw new AccessControlException(req.getMethod() + "String_Node_Str" + url+ "String_Node_Str"+ e.getMessage());
  }
}