Program: 51080
Project: 51080
Buggy source:
/** 
 * Note: This method automatically sets the nonce and timestamp.
 */
@Override public ClientResponse handle(final ClientRequest request) throws ClientHandlerException {
  if (!request.getHeaders().containsKey("String_Node_Str")) {
switch (state) {
case MANAGED:
      if (parameters.getToken() == null) {
        state=State.UNMANAGED;
        try {
          ClientResponse cr=handle(ClientRequest.create().build(requestTokenUri,HttpMethod.POST));
          Form response=cr.getEntity(Form.class);
          String token=response.getFirst(OAuthParameters.TOKEN);
          parameters.token(token);
          secrets.tokenSecret(response.getFirst(OAuthParameters.TOKEN_SECRET));
          state=State.REQUEST_TOKEN;
          parameters.verifier(handler.authorize(getAuthorizationUri()));
          return handle(request);
        }
  finally {
          if (state == State.UNMANAGED) {
            parameters.setToken(null);
            secrets.setTokenSecret(null);
          }
          state=State.MANAGED;
        }
      }
    break;
case REQUEST_TOKEN:
  if (parameters.getVerifier() == null) {
    throw new UnauthorizedRequestException(parameters,getAuthorizationUri());
  }
state=State.UNMANAGED;
try {
ClientResponse cr=handle(ClientRequest.create().build(accessTokenUri,HttpMethod.POST));
Form response=cr.getEntity(Form.class);
String token=response.getFirst(OAuthParameters.TOKEN);
String secret=response.getFirst(OAuthParameters.TOKEN_SECRET);
if (token == null) {
  throw new UnauthorizedRequestException(parameters,null);
}
parameters.token(token);
secrets.tokenSecret(secret);
handler.authorized(parameters.getToken(),secrets.getTokenSecret());
state=State.MANAGED;
}
  finally {
parameters.remove(OAuthParameters.VERIFIER);
if (state == State.UNMANAGED) {
  parameters.remove(OAuthParameters.TOKEN);
  secrets.tokenSecret(null);
  state=State.MANAGED;
}
}
}
final OAuthParameters p=(OAuthParameters)parameters.clone();
if (p.getTimestamp() == null) {
p.setTimestamp();
}
if (p.getNonce() == null) {
p.setNonce();
}
try {
OAuthSignature.sign(new RequestWrapper(request,providers),p,secrets);
}
 catch (OAuthSignatureException se) {
throw new ClientHandlerException(se);
}
}
ClientResponse response;
UniformInterfaceException uie=null;
try {
response=getNext().handle(request);
}
 catch (UniformInterfaceException e) {
response=e.getResponse();
uie=e;
}
if (state == State.MANAGED && response.getClientResponseStatus() == ClientResponse.Status.UNAUTHORIZED) {
request.getHeaders().remove("String_Node_Str");
parameters.remove(OAuthParameters.TOKEN);
secrets.tokenSecret(null);
uie=null;
return handle(request);
}
if (uie != null) {
throw uie;
}
return response;
}

Fixed version (ground truth):
/** 
 * Note: This method automatically sets the nonce and timestamp.
 */
@Override public ClientResponse handle(final ClientRequest request) throws ClientHandlerException {
  if (!request.getHeaders().containsKey("String_Node_Str")) {
switch (state) {
case MANAGED:
      if (parameters.getToken() == null) {
        state=State.UNMANAGED;
        try {
          ClientResponse cr=handle(ClientRequest.create().build(requestTokenUri,HttpMethod.POST));
          Form response=cr.getEntity(Form.class);
          String token=response.getFirst(OAuthParameters.TOKEN);
          parameters.token(token);
          secrets.tokenSecret(response.getFirst(OAuthParameters.TOKEN_SECRET));
          state=State.REQUEST_TOKEN;
          parameters.verifier(handler.authorize(getAuthorizationUri()));
          return handle(request);
        }
  finally {
          if (state == State.UNMANAGED) {
            parameters.setToken(null);
            secrets.setTokenSecret(null);
          }
          if (state != State.REQUEST_TOKEN) {
            state=State.MANAGED;
          }
        }
      }
    break;
case REQUEST_TOKEN:
  if (parameters.getVerifier() == null) {
    throw new UnauthorizedRequestException(parameters,getAuthorizationUri());
  }
state=State.UNMANAGED;
try {
ClientResponse cr=handle(ClientRequest.create().build(accessTokenUri,HttpMethod.POST));
Form response=cr.getEntity(Form.class);
String token=response.getFirst(OAuthParameters.TOKEN);
String secret=response.getFirst(OAuthParameters.TOKEN_SECRET);
if (token == null) {
  throw new UnauthorizedRequestException(parameters,null);
}
parameters.token(token);
secrets.tokenSecret(secret);
handler.authorized(parameters.getToken(),secrets.getTokenSecret());
state=State.MANAGED;
}
  finally {
parameters.remove(OAuthParameters.VERIFIER);
if (state == State.UNMANAGED) {
  parameters.remove(OAuthParameters.TOKEN);
  secrets.tokenSecret(null);
  state=State.MANAGED;
}
}
}
final OAuthParameters p=(OAuthParameters)parameters.clone();
if (p.getTimestamp() == null) {
p.setTimestamp();
}
if (p.getNonce() == null) {
p.setNonce();
}
try {
OAuthSignature.sign(new RequestWrapper(request,providers),p,secrets);
}
 catch (OAuthSignatureException se) {
throw new ClientHandlerException(se);
}
}
ClientResponse response;
UniformInterfaceException uie=null;
try {
response=getNext().handle(request);
}
 catch (UniformInterfaceException e) {
response=e.getResponse();
uie=e;
}
if (state == State.MANAGED && response.getClientResponseStatus() == ClientResponse.Status.UNAUTHORIZED) {
request.getHeaders().remove("String_Node_Str");
parameters.remove(OAuthParameters.TOKEN);
secrets.tokenSecret(null);
uie=null;
return handle(request);
}
if (uie != null) {
throw uie;
}
return response;
}