Program: 9087
Project: 9087
Buggy source:
/** 
 * Gets and processes the Single <code>LogoutResponse</code> from IDP, destroys the local session, checks response's issuer and inResponseTo.
 * @param request the HttpServletRequest.
 * @param response the HttpServletResponse.
 * @param samlResponse <code>LogoutResponse</code> in theXML string format.
 * @param relayState the target URL on successful<code>LogoutResponse</code>.
 * @throws SAML2Exception if error processing<code>LogoutResponse</code>.
 * @throws SessionException if error processing<code>LogoutResponse</code>.
 */
public static Map<String,String> processLogoutResponse(HttpServletRequest request,HttpServletResponse response,String samlResponse,String relayState) throws SAML2Exception, SessionException {
  String method="String_Node_Str";
  if (debug.messageEnabled()) {
    debug.message(method + "String_Node_Str" + samlResponse);
    debug.message(method + "String_Node_Str" + relayState);
  }
  String rmethod=request.getMethod();
  String binding=SAML2Constants.HTTP_REDIRECT;
  if (rmethod.equals("String_Node_Str")) {
    binding=SAML2Constants.HTTP_POST;
  }
  String metaAlias=SAML2MetaUtils.getMetaAliasByUri(request.getRequestURI());
  if ((SPCache.isFedlet) && ((metaAlias == null) || (metaAlias.length() == 0))) {
    List spMetaAliases=sm.getAllHostedServiceProviderMetaAliases("String_Node_Str");
    if ((spMetaAliases != null) && !spMetaAliases.isEmpty()) {
      metaAlias=(String)spMetaAliases.get(0);
    }
  }
  if ((metaAlias == null) || (metaAlias.length() == 0)) {
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  String realm=SAML2Utils.getRealm(SAML2MetaUtils.getRealmByMetaAlias(metaAlias));
  String spEntityID=sm.getEntityByMetaAlias(metaAlias);
  if (!SAML2Utils.isSPProfileBindingSupported(realm,spEntityID,SAML2Constants.SLO_SERVICE,binding)) {
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  SAML2Utils.validateRelayStateURL(realm,spEntityID,relayState,SAML2Constants.SP_ROLE);
  LogoutResponse logoutRes=null;
  if (rmethod.equals("String_Node_Str")) {
    logoutRes=LogoutUtil.getLogoutResponseFromPost(samlResponse,response);
  }
 else   if (rmethod.equals("String_Node_Str")) {
    String decodedStr=SAML2Utils.decodeFromRedirect(samlResponse);
    if (decodedStr == null) {
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
    logoutRes=ProtocolFactory.getInstance().createLogoutResponse(decodedStr);
  }
  if (logoutRes == null) {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str" + "String_Node_Str");
    }
    return null;
  }
  String idpEntityID=logoutRes.getIssuer().getValue();
  Issuer resIssuer=logoutRes.getIssuer();
  String inResponseTo=logoutRes.getInResponseTo();
  LogoutRequest logoutReq=(LogoutRequest)SPCache.logoutRequestIDHash.remove(inResponseTo);
  if (logoutReq == null && SAML2FailoverUtils.isSAML2FailoverEnabled()) {
    try {
      logoutReq=(LogoutRequest)SAML2FailoverUtils.retrieveSAML2Token(inResponseTo);
    }
 catch (    SAML2TokenRepositoryException e) {
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
  }
 else {
    logoutReq=(LogoutRequest)SAML2Store.getTokenFromStore(inResponseTo);
  }
  String userId=null;
  if (!SPCache.isFedlet) {
    userId=preSingleLogoutProcess(spEntityID,realm,request,response,null,logoutReq,logoutRes,binding);
  }
  SAML2Utils.verifyResponseIssuer(realm,spEntityID,resIssuer,inResponseTo);
  boolean needToVerify=SAML2Utils.getWantLogoutResponseSigned(realm,spEntityID,SAML2Constants.SP_ROLE);
  if (debug.messageEnabled()) {
    debug.message(method + "String_Node_Str" + metaAlias);
    debug.message(method + "String_Node_Str" + realm);
    debug.message(method + "String_Node_Str" + idpEntityID);
    debug.message(method + "String_Node_Str" + spEntityID);
  }
  Map<String,String> infoMap=new HashMap<String,String>();
  infoMap.put("String_Node_Str",spEntityID);
  infoMap.put(SAML2Constants.REALM,realm);
  if (needToVerify) {
    boolean valid=false;
    if (rmethod.equals("String_Node_Str")) {
      String queryString=request.getQueryString();
      valid=SAML2Utils.verifyQueryString(queryString,realm,SAML2Constants.SP_ROLE,idpEntityID);
    }
 else {
      valid=LogoutUtil.verifySLOResponse(logoutRes,realm,idpEntityID,spEntityID,SAML2Constants.SP_ROLE);
    }
    if (!valid) {
      debug.error("String_Node_Str" + "String_Node_Str");
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
    SPSSODescriptorElement spsso=sm.getSPSSODescriptor(realm,spEntityID);
    String loc=getSLOResponseLocationOrLocation(spsso,binding);
    if (!SAML2Utils.verifyDestination(logoutRes.getDestination(),loc)) {
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
  }
  if (inResponseTo == null || inResponseTo.length() == 0) {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str");
    }
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  if (logoutReq != null) {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str" + "String_Node_Str");
    }
  }
 else {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str" + "String_Node_Str");
    }
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  infoMap.put("String_Node_Str",inResponseTo);
  infoMap.put(SAML2Constants.RELAY_STATE,relayState);
  try {
    Object session=sessionProvider.getSession(request);
    if ((session != null) && sessionProvider.isValid(session)) {
      sessionProvider.invalidateSession(session,request,response);
    }
  }
 catch (  SessionException se) {
    debug.message("String_Node_Str" + se.getMessage());
  }
  if (!SPCache.isFedlet) {
    if (isSuccess(logoutRes)) {
      postSingleLogoutSuccess(spEntityID,realm,request,response,userId,logoutReq,logoutRes,binding);
    }
 else {
      throw new SAML2Exception(SAML2Utils.BUNDLE_NAME,"String_Node_Str",null);
    }
  }
 else {
    FedletAdapter fedletAdapter=SAML2Utils.getFedletAdapterClass(spEntityID,realm);
    if (fedletAdapter != null) {
      if (isSuccess(logoutRes)) {
        fedletAdapter.onFedletSLOSuccess(request,response,logoutReq,logoutRes,spEntityID,idpEntityID,binding);
      }
 else {
        fedletAdapter.onFedletSLOFailure(request,response,logoutReq,logoutRes,spEntityID,idpEntityID,binding);
        throw new SAML2Exception(SAML2Utils.BUNDLE_NAME,"String_Node_Str",null);
      }
    }
  }
  return infoMap;
}

Fixed version (ground truth):
/** 
 * Gets and processes the Single <code>LogoutResponse</code> from IDP, destroys the local session, checks response's issuer and inResponseTo.
 * @param request the HttpServletRequest.
 * @param response the HttpServletResponse.
 * @param samlResponse <code>LogoutResponse</code> in theXML string format.
 * @param relayState the target URL on successful<code>LogoutResponse</code>.
 * @throws SAML2Exception if error processing<code>LogoutResponse</code>.
 * @throws SessionException if error processing<code>LogoutResponse</code>.
 */
public static Map<String,String> processLogoutResponse(HttpServletRequest request,HttpServletResponse response,String samlResponse,String relayState) throws SAML2Exception, SessionException {
  String method="String_Node_Str";
  if (debug.messageEnabled()) {
    debug.message(method + "String_Node_Str" + samlResponse);
    debug.message(method + "String_Node_Str" + relayState);
  }
  String rmethod=request.getMethod();
  String binding=SAML2Constants.HTTP_REDIRECT;
  if (rmethod.equals("String_Node_Str")) {
    binding=SAML2Constants.HTTP_POST;
  }
  String metaAlias=SAML2MetaUtils.getMetaAliasByUri(request.getRequestURI());
  if ((SPCache.isFedlet) && ((metaAlias == null) || (metaAlias.length() == 0))) {
    List spMetaAliases=sm.getAllHostedServiceProviderMetaAliases("String_Node_Str");
    if ((spMetaAliases != null) && !spMetaAliases.isEmpty()) {
      metaAlias=(String)spMetaAliases.get(0);
    }
  }
  if ((metaAlias == null) || (metaAlias.length() == 0)) {
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  String realm=SAML2Utils.getRealm(SAML2MetaUtils.getRealmByMetaAlias(metaAlias));
  String spEntityID=sm.getEntityByMetaAlias(metaAlias);
  if (!SAML2Utils.isSPProfileBindingSupported(realm,spEntityID,SAML2Constants.SLO_SERVICE,binding)) {
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  SAML2Utils.validateRelayStateURL(realm,spEntityID,relayState,SAML2Constants.SP_ROLE);
  LogoutResponse logoutRes=null;
  if (rmethod.equals("String_Node_Str")) {
    logoutRes=LogoutUtil.getLogoutResponseFromPost(samlResponse,response);
  }
 else   if (rmethod.equals("String_Node_Str")) {
    String decodedStr=SAML2Utils.decodeFromRedirect(samlResponse);
    if (decodedStr == null) {
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
    logoutRes=ProtocolFactory.getInstance().createLogoutResponse(decodedStr);
  }
  if (logoutRes == null) {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str" + "String_Node_Str");
    }
    return null;
  }
  String idpEntityID=logoutRes.getIssuer().getValue();
  Issuer resIssuer=logoutRes.getIssuer();
  String inResponseTo=logoutRes.getInResponseTo();
  LogoutRequest logoutReq=(LogoutRequest)SPCache.logoutRequestIDHash.remove(inResponseTo);
  if (logoutReq == null) {
    logoutReq=(LogoutRequest)SAML2Store.getTokenFromStore(inResponseTo);
  }
  if (logoutReq == null && SAML2FailoverUtils.isSAML2FailoverEnabled()) {
    try {
      logoutReq=(LogoutRequest)SAML2FailoverUtils.retrieveSAML2Token(inResponseTo);
    }
 catch (    SAML2TokenRepositoryException e) {
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
  }
  String userId=null;
  if (!SPCache.isFedlet) {
    userId=preSingleLogoutProcess(spEntityID,realm,request,response,null,logoutReq,logoutRes,binding);
  }
  SAML2Utils.verifyResponseIssuer(realm,spEntityID,resIssuer,inResponseTo);
  boolean needToVerify=SAML2Utils.getWantLogoutResponseSigned(realm,spEntityID,SAML2Constants.SP_ROLE);
  if (debug.messageEnabled()) {
    debug.message(method + "String_Node_Str" + metaAlias);
    debug.message(method + "String_Node_Str" + realm);
    debug.message(method + "String_Node_Str" + idpEntityID);
    debug.message(method + "String_Node_Str" + spEntityID);
  }
  Map<String,String> infoMap=new HashMap<String,String>();
  infoMap.put("String_Node_Str",spEntityID);
  infoMap.put(SAML2Constants.REALM,realm);
  if (needToVerify) {
    boolean valid=false;
    if (rmethod.equals("String_Node_Str")) {
      String queryString=request.getQueryString();
      valid=SAML2Utils.verifyQueryString(queryString,realm,SAML2Constants.SP_ROLE,idpEntityID);
    }
 else {
      valid=LogoutUtil.verifySLOResponse(logoutRes,realm,idpEntityID,spEntityID,SAML2Constants.SP_ROLE);
    }
    if (!valid) {
      debug.error("String_Node_Str" + "String_Node_Str");
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
    SPSSODescriptorElement spsso=sm.getSPSSODescriptor(realm,spEntityID);
    String loc=getSLOResponseLocationOrLocation(spsso,binding);
    if (!SAML2Utils.verifyDestination(logoutRes.getDestination(),loc)) {
      throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
    }
  }
  if (inResponseTo == null || inResponseTo.length() == 0) {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str");
    }
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  if (logoutReq != null) {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str" + "String_Node_Str");
    }
  }
 else {
    if (debug.messageEnabled()) {
      debug.message("String_Node_Str" + "String_Node_Str");
    }
    throw new SAML2Exception(SAML2Utils.bundle.getString("String_Node_Str"));
  }
  infoMap.put("String_Node_Str",inResponseTo);
  infoMap.put(SAML2Constants.RELAY_STATE,relayState);
  try {
    Object session=sessionProvider.getSession(request);
    if ((session != null) && sessionProvider.isValid(session)) {
      sessionProvider.invalidateSession(session,request,response);
    }
  }
 catch (  SessionException se) {
    debug.message("String_Node_Str" + se.getMessage());
  }
  if (!SPCache.isFedlet) {
    if (isSuccess(logoutRes)) {
      postSingleLogoutSuccess(spEntityID,realm,request,response,userId,logoutReq,logoutRes,binding);
    }
 else {
      throw new SAML2Exception(SAML2Utils.BUNDLE_NAME,"String_Node_Str",null);
    }
  }
 else {
    FedletAdapter fedletAdapter=SAML2Utils.getFedletAdapterClass(spEntityID,realm);
    if (fedletAdapter != null) {
      if (isSuccess(logoutRes)) {
        fedletAdapter.onFedletSLOSuccess(request,response,logoutReq,logoutRes,spEntityID,idpEntityID,binding);
      }
 else {
        fedletAdapter.onFedletSLOFailure(request,response,logoutReq,logoutRes,spEntityID,idpEntityID,binding);
        throw new SAML2Exception(SAML2Utils.BUNDLE_NAME,"String_Node_Str",null);
      }
    }
  }
  return infoMap;
}