Program: 17930
Project: 17930
Buggy source:
/** 
 * Handle the secured requests.  {@inheritDoc} 
 */
@Override public void doFilter(ServletRequest sreq,ServletResponse sres,FilterChain chain) throws IOException, ServletException {
  HttpServletRequest request=(HttpServletRequest)sreq;
  HttpServletResponse response=(HttpServletResponse)sres;
  if (request.getAttribute(FILTER_ALREADY_VISITED) != null) {
    chain.doFilter(request,response);
    return;
  }
  SecurityContext sc=null;
  if (!ForceOAuthConnector.REDIRECT_AUTH_URI.equals(request.getServletPath())) {
    sc=securityContextService.getSecurityContextFromSession(request);
  }
  if (isLogoutUrl(request)) {
    logout(request,response,sc,chain);
    return;
  }
  if (sc == null) {
    doOAuthLogin(request,response);
    return;
  }
 else {
    securityContextService.setSecurityContextToSession(request,response,sc);
  }
  ForceSecurityContextHolder.set(sc);
  ForceConnectorConfig cc=new ForceConnectorConfig();
  cc.setSessionId(sc.getSessionId());
  cc.setServiceEndpoint(sc.getEndPoint());
  cc.setSessionRenewer(this);
  try {
    ForceServiceConnector.setThreadLocalConnectorConfig(cc);
    request.setAttribute(FILTER_ALREADY_VISITED,Boolean.TRUE);
    chain.doFilter(new AuthenticatedRequestWrapper(request,sc),response);
  }
 catch (  ForceOAuthSessionExpirationException e) {
    doOAuthLogin(request,response);
  }
catch (  SecurityException se) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN,request.getRequestURI());
  }
 finally {
    try {
      request.removeAttribute(FILTER_ALREADY_VISITED);
    }
  finally {
      ForceSecurityContextHolder.release();
      ForceServiceConnector.setThreadLocalConnectorConfig(null);
    }
  }
}

Fixed version (ground truth):
/** 
 * Handle the secured requests.  {@inheritDoc} 
 */
@Override public void doFilter(ServletRequest sreq,ServletResponse sres,FilterChain chain) throws IOException, ServletException {
  HttpServletRequest request=(HttpServletRequest)sreq;
  HttpServletResponse response=(HttpServletResponse)sres;
  if (request.getAttribute(FILTER_ALREADY_VISITED) != null) {
    chain.doFilter(request,response);
    return;
  }
  SecurityContext sc=null;
  if (!ForceOAuthConnector.REDIRECT_AUTH_URI.equals(request.getServletPath())) {
    sc=securityContextService.getSecurityContextFromSession(request);
  }
  if (isLogoutUrl(request)) {
    if (sc != null) {
      logout(request,response,sc,chain);
      return;
    }
 else {
      chain.doFilter(request,response);
    }
  }
  if (sc == null) {
    doOAuthLogin(request,response);
    return;
  }
 else {
    securityContextService.setSecurityContextToSession(request,response,sc);
  }
  ForceSecurityContextHolder.set(sc);
  ForceConnectorConfig cc=new ForceConnectorConfig();
  cc.setSessionId(sc.getSessionId());
  cc.setServiceEndpoint(sc.getEndPoint());
  cc.setSessionRenewer(this);
  try {
    ForceServiceConnector.setThreadLocalConnectorConfig(cc);
    request.setAttribute(FILTER_ALREADY_VISITED,Boolean.TRUE);
    chain.doFilter(new AuthenticatedRequestWrapper(request,sc),response);
  }
 catch (  ForceOAuthSessionExpirationException e) {
    doOAuthLogin(request,response);
  }
catch (  SecurityException se) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN,request.getRequestURI());
  }
 finally {
    try {
      request.removeAttribute(FILTER_ALREADY_VISITED);
    }
  finally {
      ForceSecurityContextHolder.release();
      ForceServiceConnector.setThreadLocalConnectorConfig(null);
    }
  }
}