Program: 31364
Project: 31364
Buggy source:
/** 
 * Create an object based on the <code>className</code> parameter.
 * @param className	The name of the class to construct. Should be a fully qualified name andgenerally the same as type <code>T</code>
 * @param typeName	A type name used in error messages / exceptions.
 * @return	An object of type <code>className</code>, which is cast to type <code>T</code>.
 * @throws ConfigurationException thrown if class name not found in class path, or does nothave a public, no-argument constructor, or is not a concrete class, or if it is not a sub-type of <code>T</code> (or <code>T</code> itself). Usually this is caused by a misconfiguration of the class names specified in the ESAPI.properties file. Also thrown if the CTOR of the specified <code>className</code> throws an <code>Exception</code> of some type.
 */
@SuppressWarnings({"String_Node_Str"}) public T make(String className,String typeName) throws ConfigurationException {
  Object obj=null;
  String errMsg=null;
  try {
    if (null == className || "String_Node_Str".equals(className)) {
      throw new IllegalArgumentException("String_Node_Str");
    }
    if (null == typeName || "String_Node_Str".equals(typeName)) {
      typeName="String_Node_Str";
    }
    Class<?> theClass=Class.forName(className);
    obj=theClass.newInstance();
    return (T)obj;
  }
 catch (  IllegalArgumentException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str";
    System.out.println(errMsg);
    throw new ConfigurationException(errMsg,ex);
  }
catch (  ClassNotFoundException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    System.out.println(errMsg);
    throw new ConfigurationException(errMsg,ex);
  }
catch (  InstantiationException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    System.out.println(errMsg);
    throw new ConfigurationException(errMsg,ex);
  }
catch (  IllegalAccessException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    System.out.println(errMsg);
    throw new ConfigurationException(errMsg,ex);
  }
catch (  ClassCastException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    System.out.println(errMsg);
    throw new ConfigurationException(errMsg,ex);
  }
catch (  Exception ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    System.out.println(errMsg);
    throw new ConfigurationException(errMsg,ex);
  }
}

Fixed version (ground truth):
/** 
 * Create an object based on the <code>className</code> parameter.
 * @param className	The name of the class to construct. Should be a fully qualified name andgenerally the same as type <code>T</code>
 * @param typeName	A type name used in error messages / exceptions.
 * @return	An object of type <code>className</code>, which is cast to type <code>T</code>.
 * @throws ConfigurationException thrown if class name not found in class path, or does nothave a public, no-argument constructor, or is not a concrete class, or if it is not a sub-type of <code>T</code> (or <code>T</code> itself). Usually this is caused by a misconfiguration of the class names specified in the ESAPI.properties file. Also thrown if the CTOR of the specified <code>className</code> throws an <code>Exception</code> of some type.
 */
@SuppressWarnings({"String_Node_Str"}) public T make(String className,String typeName) throws ConfigurationException {
  Object obj=null;
  String errMsg=null;
  try {
    if (null == className || "String_Node_Str".equals(className)) {
      throw new IllegalArgumentException("String_Node_Str");
    }
    if (null == typeName || "String_Node_Str".equals(typeName)) {
      typeName="String_Node_Str";
    }
    Class<?> theClass=Class.forName(className);
    obj=theClass.newInstance();
    return (T)obj;
  }
 catch (  IllegalArgumentException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str";
    throw new ConfigurationException(errMsg,ex);
  }
catch (  ClassNotFoundException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    throw new ConfigurationException(errMsg,ex);
  }
catch (  InstantiationException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    throw new ConfigurationException(errMsg,ex);
  }
catch (  IllegalAccessException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    throw new ConfigurationException(errMsg,ex);
  }
catch (  ClassCastException ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    throw new ConfigurationException(errMsg,ex);
  }
catch (  Exception ex) {
    errMsg=ex.toString() + "String_Node_Str" + typeName+ "String_Node_Str"+ className+ "String_Node_Str";
    throw new ConfigurationException(errMsg,ex);
  }
}