Program: 31387
Project: 31387
Buggy source:
/** 
 * Loads access rules by storing them in a hashmap.  This method begins reading the File specified by the ruleset parameter, ignoring any lines that begin with '#' characters as comments.  Sections of the access rules file are split by the pipe character ('|').  The method then loads all Classes, loads the list of comma separated roles, then the list of comma separated actions.   The roles are validated to be sure they are within a length and character set, specified in the validateRoles(String) method.   Each path may only appear once in the access rules file.  Any entry, after the first, containing the same path will be logged and ignored. 
 * @param ruleset the name of the data that contains access rules
 * @return a hash map containing the ruleset
 */
private Map loadDataRules(String ruleset){
  Map map=new HashMap();
  InputStream is=null;
  try {
    is=ESAPI.securityConfiguration().getResourceStream(ruleset);
    String line="String_Node_Str";
    while ((line=ESAPI.validator().safeReadLine(is,500)) != null) {
      if (line.length() > 0 && line.charAt(0) != '#') {
        Rule rule=new Rule();
        String[] parts=line.split("String_Node_Str");
        rule.clazz=Class.forName(parts[0].trim());
        List roles=commaSplit(parts[1].trim().toLowerCase());
        roles=validateRoles(roles);
        for (int x=0; x < roles.size(); x++)         rule.roles.add(((String)roles.get(x)).trim());
        List action=commaSplit(parts[2].trim().toLowerCase());
        for (int x=0; x < action.size(); x++)         rule.actions.add(((String)action.get(x)).trim());
        if (map.containsKey(rule.path)) {
          logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str" + rule);
        }
 else {
          map.put(rule.clazz,rule);
        }
      }
    }
  }
 catch (  Exception e) {
    logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str" + ruleset,e);
  }
 finally {
    try {
      if (is != null) {
        is.close();
      }
    }
 catch (    IOException e) {
      logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str" + ruleset,e);
    }
  }
  return map;
}

Fixed version (ground truth):
/** 
 * Loads access rules by storing them in a hashmap.  This method begins reading the File specified by the ruleset parameter, ignoring any lines that begin with '#' characters as comments.  Sections of the access rules file are split by the pipe character ('|').  The method then loads all Classes, loads the list of comma separated roles, then the list of comma separated actions.   The roles are validated to be sure they are within a length and character set, specified in the validateRoles(String) method.   Each path may only appear once in the access rules file.  Any entry, after the first, containing the same path will be logged and ignored. 
 * @param ruleset the name of the data that contains access rules
 * @return a hash map containing the ruleset
 */
private Map loadDataRules(String ruleset){
  Map map=new HashMap();
  InputStream is=null;
  try {
    ruleset="String_Node_Str" + ruleset;
    is=ESAPI.securityConfiguration().getResourceStream(ruleset);
    String line="String_Node_Str";
    while ((line=ESAPI.validator().safeReadLine(is,500)) != null) {
      if (line.length() > 0 && line.charAt(0) != '#') {
        Rule rule=new Rule();
        String[] parts=line.split("String_Node_Str");
        rule.clazz=Class.forName(parts[0].trim());
        List roles=commaSplit(parts[1].trim().toLowerCase());
        roles=validateRoles(roles);
        for (int x=0; x < roles.size(); x++)         rule.roles.add(((String)roles.get(x)).trim());
        List action=commaSplit(parts[2].trim().toLowerCase());
        for (int x=0; x < action.size(); x++)         rule.actions.add(((String)action.get(x)).trim());
        if (map.containsKey(rule.path)) {
          logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str" + rule);
        }
 else {
          map.put(rule.clazz,rule);
        }
      }
    }
  }
 catch (  Exception e) {
    logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str" + ruleset,e);
  }
 finally {
    try {
      if (is != null) {
        is.close();
      }
    }
 catch (    IOException e) {
      logger.warning(Logger.SECURITY_FAILURE,"String_Node_Str" + ruleset,e);
    }
  }
  return map;
}