Program: 34864
Project: 34864
Buggy source:
@Override @Sensitive public CredentialValidationResult validate(Credential credential){
  if (!validationTypes().contains(ValidationType.VALIDATE)) {
    return CredentialValidationResult.NOT_VALIDATED_RESULT;
  }
  if (!(credential instanceof UsernamePasswordCredential)) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str");
    }
    return CredentialValidationResult.NOT_VALIDATED_RESULT;
  }
  UsernamePasswordCredential cred=(UsernamePasswordCredential)credential;
  String caller=cred.getCaller();
  if (caller == null) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str");
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  if (cred.getPassword().getValue() == null) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str");
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  ProtectedString dbPassword=null;
  PreparedStatement prep=null;
  try {
    Connection conn=getConnection(caller);
    try {
      prep=conn.prepareStatement(idStoreDefinition.getCallerQuery());
      prep.setString(1,caller);
      ResultSet result=runQuery(prep,caller);
      if (!result.next()) {
        if (tc.isEventEnabled()) {
          Tr.event(tc,"String_Node_Str" + caller + "String_Node_Str"+ idStoreDefinition.getCallerQuery());
        }
        return CredentialValidationResult.INVALID_RESULT;
      }
      dbPassword=new ProtectedString(result.getString(1).toCharArray());
      if (result.next()) {
        result.last();
        if (tc.isEventEnabled()) {
          Tr.event(tc,"String_Node_Str" + caller,result.getRow());
        }
        return CredentialValidationResult.INVALID_RESULT;
      }
    }
  finally {
      conn.close();
    }
  }
 catch (  NamingException|SQLException e) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str" + caller,e);
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  if (dbPassword.isEmpty()) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str" + caller);
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  if (passwordHash.verify(cred.getPassword().getValue(),String.valueOf(dbPassword.getChars()))) {
    Set<String> groups=getCallerGroups(new CredentialValidationResult(null,caller,caller,caller,null));
    return new CredentialValidationResult(storeId,caller,caller,caller,groups);
  }
 else {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str" + caller);
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
}

Fixed version (ground truth):
@Override @Sensitive public CredentialValidationResult validate(Credential credential){
  if (!validationTypes().contains(ValidationType.VALIDATE)) {
    return CredentialValidationResult.NOT_VALIDATED_RESULT;
  }
  if (!(credential instanceof UsernamePasswordCredential)) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str");
    }
    return CredentialValidationResult.NOT_VALIDATED_RESULT;
  }
  UsernamePasswordCredential cred=(UsernamePasswordCredential)credential;
  String caller=cred.getCaller();
  if (caller == null) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str");
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  if (cred.getPassword().getValue() == null) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str");
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  ProtectedString dbPassword=null;
  PreparedStatement prep=null;
  try {
    Connection conn=getConnection(caller);
    try {
      prep=conn.prepareStatement(idStoreDefinition.getCallerQuery());
      prep.setString(1,caller);
      ResultSet result=runQuery(prep,caller);
      if (!result.next()) {
        if (tc.isEventEnabled()) {
          Tr.event(tc,"String_Node_Str" + caller + "String_Node_Str"+ idStoreDefinition.getCallerQuery());
        }
        return CredentialValidationResult.INVALID_RESULT;
      }
      String dbreturn=result.getString(1);
      if (dbreturn == null) {
        if (tc.isEventEnabled()) {
          Tr.event(tc,"String_Node_Str" + caller);
        }
        return CredentialValidationResult.INVALID_RESULT;
      }
      dbPassword=new ProtectedString(dbreturn.toCharArray());
      if (result.next()) {
        if (tc.isEventEnabled()) {
          Tr.event(tc,"String_Node_Str" + caller);
        }
        return CredentialValidationResult.INVALID_RESULT;
      }
    }
  finally {
      conn.close();
    }
  }
 catch (  NamingException|SQLException e) {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str" + caller,e);
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
  if (passwordHash.verify(cred.getPassword().getValue(),String.valueOf(dbPassword.getChars()))) {
    Set<String> groups=getCallerGroups(new CredentialValidationResult(null,caller,caller,caller,null));
    return new CredentialValidationResult(storeId,caller,caller,caller,groups);
  }
 else {
    if (tc.isEventEnabled()) {
      Tr.event(tc,"String_Node_Str" + caller);
    }
    return CredentialValidationResult.INVALID_RESULT;
  }
}