Program: 31394
Project: 31394
Buggy source:
/** 
 * The doFilter method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain.
 * @param req Request object to be processed
 * @param resp Response object
 * @param chain current FilterChain
 * @exception IOException if any occurs
 */
public void doFilter(ServletRequest req,ServletResponse resp,FilterChain chain) throws IOException {
  HttpServletRequest request=(HttpServletRequest)req;
  HttpServletResponse response=(HttpServletResponse)resp;
  ESAPI.httpUtilities().setCurrentHTTP(request,response);
  try {
    try {
      ESAPI.authenticator().login(request,response);
    }
 catch (    AuthenticationException e) {
      ESAPI.authenticator().logout();
      request.setAttribute("String_Node_Str","String_Node_Str");
      RequestDispatcher dispatcher=request.getRequestDispatcher("String_Node_Str");
      dispatcher.forward(request,response);
      return;
    }
    ESAPI.httpUtilities().logHTTPRequest(request,logger,Arrays.asList(obfuscate));
    if (!ESAPI.accessController().isAuthorizedForURL(request.getRequestURI().toString())) {
      request.setAttribute("String_Node_Str","String_Node_Str");
      RequestDispatcher dispatcher=request.getRequestDispatcher("String_Node_Str");
      dispatcher.forward(request,response);
      return;
    }
    if (!ESAPI.validator().isValidHTTPRequest()) {
      request.setAttribute("String_Node_Str","String_Node_Str");
      RequestDispatcher dispatcher=request.getRequestDispatcher("String_Node_Str");
      dispatcher.forward(request,response);
      return;
    }
    chain.doFilter(request,response);
    ESAPI.httpUtilities().setSafeContentType(response);
    ESAPI.httpUtilities().setNoCacheHeaders(response);
  }
 catch (  Exception e) {
    e.printStackTrace();
    logger.error(Logger.SECURITY,false,"String_Node_Str" + e.getMessage(),e);
    request.setAttribute("String_Node_Str",e.getMessage());
  }
 finally {
    ESAPI.authenticator().clearCurrent();
    ESAPI.httpUtilities().setCurrentHTTP(null,null);
  }
}

Fixed version (ground truth):
/** 
 * The doFilter method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain.
 * @param req Request object to be processed
 * @param resp Response object
 * @param chain current FilterChain
 * @exception IOException if any occurs
 */
public void doFilter(ServletRequest req,ServletResponse resp,FilterChain chain) throws IOException {
  HttpServletRequest request=(HttpServletRequest)req;
  HttpServletResponse response=(HttpServletResponse)resp;
  ESAPI.httpUtilities().setCurrentHTTP(request,response);
  try {
    try {
      ESAPI.authenticator().login(request,response);
    }
 catch (    AuthenticationException e) {
      ESAPI.authenticator().logout();
      request.setAttribute("String_Node_Str","String_Node_Str");
      RequestDispatcher dispatcher=request.getRequestDispatcher("String_Node_Str");
      dispatcher.forward(request,response);
      return;
    }
    ESAPI.httpUtilities().logHTTPRequest(request,logger,Arrays.asList(obfuscate));
    if (!ESAPI.accessController().isAuthorizedForURL(request.getRequestURI())) {
      request.setAttribute("String_Node_Str","String_Node_Str");
      RequestDispatcher dispatcher=request.getRequestDispatcher("String_Node_Str");
      dispatcher.forward(request,response);
      return;
    }
    if (!ESAPI.validator().isValidHTTPRequest()) {
      request.setAttribute("String_Node_Str","String_Node_Str");
      RequestDispatcher dispatcher=request.getRequestDispatcher("String_Node_Str");
      dispatcher.forward(request,response);
      return;
    }
    chain.doFilter(request,response);
    ESAPI.httpUtilities().setSafeContentType(response);
    ESAPI.httpUtilities().setNoCacheHeaders(response);
  }
 catch (  Exception e) {
    e.printStackTrace();
    logger.error(Logger.SECURITY,false,"String_Node_Str" + e.getMessage(),e);
    request.setAttribute("String_Node_Str",e.getMessage());
  }
 finally {
    ESAPI.authenticator().clearCurrent();
    ESAPI.httpUtilities().setCurrentHTTP(null,null);
  }
}