Program: 31393
Project: 31393
Buggy source:
/** 
 * Add a cookie to the response after ensuring that there are no encoded or illegal characters in the name and name and value. This method also sets the secure and HttpOnly flags on the cookie. This implementation uses a custom "set-cookie" header instead of using Java's cookie interface which doesn't allow the use of HttpOnly.
 */
public void addCookie(Cookie cookie){
  String name=cookie.getName();
  String value=cookie.getValue();
  int maxAge=cookie.getMaxAge();
  String domain=cookie.getDomain();
  String path=cookie.getPath();
  boolean secure=cookie.getSecure();
  ValidationErrorList errors=new ValidationErrorList();
  String cookieName=ESAPI.validator().getValidInput("String_Node_Str",name,"String_Node_Str",50,false,errors);
  String cookieValue=ESAPI.validator().getValidInput("String_Node_Str",value,"String_Node_Str",5000,false,errors);
  if (errors.size() == 0) {
    String header=createCookieHeader(name,value,maxAge,domain,path,secure);
    this.addHeader("String_Node_Str",header);
    return;
  }
  if (mode.equals("String_Node_Str")) {
    logger.warning(Logger.SECURITY,false,"String_Node_Str");
    return;
  }
  if (mode.equals("String_Node_Str")) {
    logger.warning(Logger.SECURITY,false,"String_Node_Str");
    this.addCookie(cookie);
    return;
  }
  if (mode.equals("String_Node_Str")) {
    logger.warning(Logger.SECURITY,false,"String_Node_Str");
    String header=createCookieHeader(cookieName,cookieValue,maxAge,domain,path,secure);
    this.addHeader("String_Node_Str",header);
    return;
  }
  throw new IntrusionException("String_Node_Str","String_Node_Str");
}

Fixed version (ground truth):
/** 
 * Add a cookie to the response after ensuring that there are no encoded or illegal characters in the name and name and value. This method also sets the secure and HttpOnly flags on the cookie. This implementation uses a custom "set-cookie" header instead of using Java's cookie interface which doesn't allow the use of HttpOnly.
 */
public void addCookie(Cookie cookie){
  String name=cookie.getName();
  String value=cookie.getValue();
  int maxAge=cookie.getMaxAge();
  String domain=cookie.getDomain();
  String path=cookie.getPath();
  boolean secure=cookie.getSecure();
  ValidationErrorList errors=new ValidationErrorList();
  String cookieName=ESAPI.validator().getValidInput("String_Node_Str",name,"String_Node_Str",50,false,errors);
  String cookieValue=ESAPI.validator().getValidInput("String_Node_Str",value,"String_Node_Str",5000,false,errors);
  if (errors.size() == 0) {
    String header=createCookieHeader(name,value,maxAge,domain,path,secure);
    this.addHeader("String_Node_Str",header);
    return;
  }
  if (mode.equals("String_Node_Str")) {
    logger.warning(Logger.SECURITY,false,"String_Node_Str");
    return;
  }
  if (mode.equals("String_Node_Str")) {
    logger.warning(Logger.SECURITY,false,"String_Node_Str");
    response.addCookie(cookie);
    return;
  }
  if (mode.equals("String_Node_Str")) {
    logger.warning(Logger.SECURITY,false,"String_Node_Str");
    String header=createCookieHeader(cookieName,cookieValue,maxAge,domain,path,secure);
    this.addHeader("String_Node_Str",header);
    return;
  }
  throw new IntrusionException("String_Node_Str","String_Node_Str");
}