Program: 89264
Project: 89264
Buggy source:
@Override public List<VolumeVO> searchForVolumes(ListVolumesCmd cmd){
  Account caller=UserContext.current().getCaller();
  Long domainId=cmd.getDomainId();
  String accountName=cmd.getAccountName();
  List<Long> permittedAccounts=new ArrayList<Long>();
  boolean isAdmin=false;
  Boolean isRecursive=cmd.isRecursive();
  Long projectId=cmd.getProjectId();
  if (isRecursive == null) {
    isRecursive=false;
  }
  if ((caller == null) || isAdmin(caller.getType())) {
    isAdmin=true;
    if (domainId != null) {
      if ((caller != null) && !_domainDao.isChildDomain(caller.getDomainId(),domainId)) {
        throw new PermissionDeniedException("String_Node_Str" + domainId + "String_Node_Str");
      }
      if (accountName != null) {
        Account userAccount=_accountDao.findActiveAccount(accountName,domainId);
        if (userAccount != null) {
          permittedAccounts.add(userAccount.getId());
        }
 else {
          throw new InvalidParameterValueException("String_Node_Str" + accountName + "String_Node_Str"+ domainId);
        }
      }
    }
 else {
      domainId=((caller == null) ? DomainVO.ROOT_DOMAIN : caller.getDomainId());
      isRecursive=true;
    }
  }
 else {
    permittedAccounts.add(caller.getId());
  }
  if (projectId != null) {
    permittedAccounts.clear();
    Project project=_projectMgr.getProject(projectId);
    if (project == null) {
      throw new InvalidParameterValueException("String_Node_Str" + projectId);
    }
    if (!_projectMgr.canAccessProjectAccount(caller,project.getProjectAccountId())) {
      throw new InvalidParameterValueException("String_Node_Str" + caller + "String_Node_Str"+ projectId);
    }
    permittedAccounts.add(project.getProjectAccountId());
  }
 else   if (caller.getType() == Account.ACCOUNT_TYPE_NORMAL) {
    permittedAccounts.addAll(_projectMgr.listPermittedProjectAccounts(caller.getId()));
  }
  Filter searchFilter=new Filter(VolumeVO.class,"String_Node_Str",false,cmd.getStartIndex(),cmd.getPageSizeVal());
  Object id=cmd.getId();
  Long vmInstanceId=cmd.getVirtualMachineId();
  Object name=cmd.getVolumeName();
  Object keyword=cmd.getKeyword();
  Object type=cmd.getType();
  Object zone=null;
  Object pod=null;
  if (isAdmin) {
    zone=cmd.getZoneId();
    pod=cmd.getPodId();
  }
 else {
    domainId=null;
  }
  SearchBuilder<VolumeVO> sb=_volumeDao.createSearchBuilder();
  sb.and("String_Node_Str",sb.entity().getName(),SearchCriteria.Op.LIKE);
  sb.and("String_Node_Str",sb.entity().getId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getAccountId(),SearchCriteria.Op.IN);
  sb.and("String_Node_Str",sb.entity().getVolumeType(),SearchCriteria.Op.LIKE);
  sb.and("String_Node_Str",sb.entity().getInstanceId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getDataCenterId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getPodId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getState(),SearchCriteria.Op.NEQ);
  SearchBuilder<DiskOfferingVO> diskOfferingSearch=_diskOfferingDao.createSearchBuilder();
  diskOfferingSearch.and("String_Node_Str",diskOfferingSearch.entity().getSystemUse(),SearchCriteria.Op.NEQ);
  sb.join("String_Node_Str",diskOfferingSearch,sb.entity().getDiskOfferingId(),diskOfferingSearch.entity().getId(),JoinBuilder.JoinType.LEFTOUTER);
  if (((permittedAccounts.isEmpty()) && (domainId != null) && isRecursive)) {
    SearchBuilder<DomainVO> domainSearch=_domainDao.createSearchBuilder();
    domainSearch.and("String_Node_Str",domainSearch.entity().getPath(),SearchCriteria.Op.LIKE);
    sb.join("String_Node_Str",domainSearch,sb.entity().getDomainId(),domainSearch.entity().getId(),JoinBuilder.JoinType.INNER);
  }
 else   if ((permittedAccounts.isEmpty()) && (domainId != null) && !isRecursive) {
    SearchBuilder<DomainVO> domainSearch=_domainDao.createSearchBuilder();
    domainSearch.and("String_Node_Str",domainSearch.entity().getPath(),SearchCriteria.Op.EQ);
    sb.join("String_Node_Str",domainSearch,sb.entity().getDomainId(),domainSearch.entity().getId(),JoinBuilder.JoinType.INNER);
  }
  SearchBuilder<VMInstanceVO> vmSearch=_vmInstanceDao.createSearchBuilder();
  vmSearch.and("String_Node_Str",vmSearch.entity().getType(),SearchCriteria.Op.NIN);
  vmSearch.or("String_Node_Str",vmSearch.entity().getType(),SearchCriteria.Op.NULL);
  sb.join("String_Node_Str",vmSearch,sb.entity().getInstanceId(),vmSearch.entity().getId(),JoinBuilder.JoinType.LEFTOUTER);
  SearchCriteria<VolumeVO> sc=sb.create();
  if (keyword != null) {
    SearchCriteria<VolumeVO> ssc=_volumeDao.createSearchCriteria();
    ssc.addOr("String_Node_Str",SearchCriteria.Op.LIKE,"String_Node_Str" + keyword + "String_Node_Str");
    ssc.addOr("String_Node_Str",SearchCriteria.Op.LIKE,"String_Node_Str" + keyword + "String_Node_Str");
    sc.addAnd("String_Node_Str",SearchCriteria.Op.SC,ssc);
  }
  if (name != null) {
    sc.setParameters("String_Node_Str","String_Node_Str" + name + "String_Node_Str");
  }
  if (id != null) {
    sc.setParameters("String_Node_Str",id);
  }
  if (!permittedAccounts.isEmpty()) {
    sc.setParameters("String_Node_Str",permittedAccounts.toArray());
    sc.setJoinParameters("String_Node_Str","String_Node_Str",1);
  }
 else   if (domainId != null) {
    DomainVO domain=_domainDao.findById(domainId);
    if (isRecursive) {
      sc.setJoinParameters("String_Node_Str","String_Node_Str",domain.getPath() + "String_Node_Str");
    }
 else {
      sc.setJoinParameters("String_Node_Str","String_Node_Str",domain.getPath());
    }
  }
  if (type != null) {
    sc.setParameters("String_Node_Str","String_Node_Str" + type + "String_Node_Str");
  }
  if (vmInstanceId != null) {
    sc.setParameters("String_Node_Str",vmInstanceId);
  }
  if (zone != null) {
    sc.setParameters("String_Node_Str",zone);
  }
  if (pod != null) {
    sc.setParameters("String_Node_Str",pod);
  }
  sc.setJoinParameters("String_Node_Str","String_Node_Str",VirtualMachine.Type.ConsoleProxy,VirtualMachine.Type.SecondaryStorageVm,VirtualMachine.Type.DomainRouter);
  sc.setParameters("String_Node_Str",Volume.State.Destroy);
  return _volumeDao.search(sc,searchFilter);
}

Fixed version (ground truth):
@Override public List<VolumeVO> searchForVolumes(ListVolumesCmd cmd){
  Account caller=UserContext.current().getCaller();
  Long domainId=cmd.getDomainId();
  String accountName=cmd.getAccountName();
  List<Long> permittedAccounts=new ArrayList<Long>();
  boolean isAdmin=false;
  Boolean isRecursive=cmd.isRecursive();
  Long projectId=cmd.getProjectId();
  if (isRecursive == null) {
    isRecursive=false;
  }
  if ((caller == null) || isAdmin(caller.getType())) {
    isAdmin=true;
    if (domainId != null) {
      if ((caller != null) && !_domainDao.isChildDomain(caller.getDomainId(),domainId)) {
        throw new PermissionDeniedException("String_Node_Str" + domainId + "String_Node_Str");
      }
      if (accountName != null) {
        Account userAccount=_accountDao.findActiveAccount(accountName,domainId);
        if (userAccount != null) {
          permittedAccounts.add(userAccount.getId());
        }
 else {
          throw new InvalidParameterValueException("String_Node_Str" + accountName + "String_Node_Str"+ domainId);
        }
      }
    }
 else {
      domainId=((caller == null) ? DomainVO.ROOT_DOMAIN : caller.getDomainId());
      isRecursive=true;
    }
  }
 else {
    permittedAccounts.add(caller.getId());
  }
  if (projectId != null) {
    permittedAccounts.clear();
    Project project=_projectMgr.getProject(projectId);
    if (project == null) {
      throw new InvalidParameterValueException("String_Node_Str" + projectId);
    }
    if (!_projectMgr.canAccessProjectAccount(caller,project.getProjectAccountId())) {
      throw new InvalidParameterValueException("String_Node_Str" + caller + "String_Node_Str"+ projectId);
    }
    permittedAccounts.add(project.getProjectAccountId());
  }
 else   if (caller.getType() == Account.ACCOUNT_TYPE_NORMAL) {
    permittedAccounts.addAll(_projectMgr.listPermittedProjectAccounts(caller.getId()));
  }
  Filter searchFilter=new Filter(VolumeVO.class,"String_Node_Str",false,cmd.getStartIndex(),cmd.getPageSizeVal());
  Object id=cmd.getId();
  Long vmInstanceId=cmd.getVirtualMachineId();
  Object name=cmd.getVolumeName();
  Object keyword=cmd.getKeyword();
  Object type=cmd.getType();
  Object zoneId=cmd.getZoneId();
  Object pod=null;
  if (isAdmin) {
    pod=cmd.getPodId();
  }
 else {
    domainId=null;
  }
  SearchBuilder<VolumeVO> sb=_volumeDao.createSearchBuilder();
  sb.and("String_Node_Str",sb.entity().getName(),SearchCriteria.Op.LIKE);
  sb.and("String_Node_Str",sb.entity().getId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getAccountId(),SearchCriteria.Op.IN);
  sb.and("String_Node_Str",sb.entity().getVolumeType(),SearchCriteria.Op.LIKE);
  sb.and("String_Node_Str",sb.entity().getInstanceId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getDataCenterId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getPodId(),SearchCriteria.Op.EQ);
  sb.and("String_Node_Str",sb.entity().getState(),SearchCriteria.Op.NEQ);
  SearchBuilder<DiskOfferingVO> diskOfferingSearch=_diskOfferingDao.createSearchBuilder();
  diskOfferingSearch.and("String_Node_Str",diskOfferingSearch.entity().getSystemUse(),SearchCriteria.Op.NEQ);
  sb.join("String_Node_Str",diskOfferingSearch,sb.entity().getDiskOfferingId(),diskOfferingSearch.entity().getId(),JoinBuilder.JoinType.LEFTOUTER);
  if (((permittedAccounts.isEmpty()) && (domainId != null) && isRecursive)) {
    SearchBuilder<DomainVO> domainSearch=_domainDao.createSearchBuilder();
    domainSearch.and("String_Node_Str",domainSearch.entity().getPath(),SearchCriteria.Op.LIKE);
    sb.join("String_Node_Str",domainSearch,sb.entity().getDomainId(),domainSearch.entity().getId(),JoinBuilder.JoinType.INNER);
  }
 else   if ((permittedAccounts.isEmpty()) && (domainId != null) && !isRecursive) {
    SearchBuilder<DomainVO> domainSearch=_domainDao.createSearchBuilder();
    domainSearch.and("String_Node_Str",domainSearch.entity().getPath(),SearchCriteria.Op.EQ);
    sb.join("String_Node_Str",domainSearch,sb.entity().getDomainId(),domainSearch.entity().getId(),JoinBuilder.JoinType.INNER);
  }
  SearchBuilder<VMInstanceVO> vmSearch=_vmInstanceDao.createSearchBuilder();
  vmSearch.and("String_Node_Str",vmSearch.entity().getType(),SearchCriteria.Op.NIN);
  vmSearch.or("String_Node_Str",vmSearch.entity().getType(),SearchCriteria.Op.NULL);
  sb.join("String_Node_Str",vmSearch,sb.entity().getInstanceId(),vmSearch.entity().getId(),JoinBuilder.JoinType.LEFTOUTER);
  SearchCriteria<VolumeVO> sc=sb.create();
  if (keyword != null) {
    SearchCriteria<VolumeVO> ssc=_volumeDao.createSearchCriteria();
    ssc.addOr("String_Node_Str",SearchCriteria.Op.LIKE,"String_Node_Str" + keyword + "String_Node_Str");
    ssc.addOr("String_Node_Str",SearchCriteria.Op.LIKE,"String_Node_Str" + keyword + "String_Node_Str");
    sc.addAnd("String_Node_Str",SearchCriteria.Op.SC,ssc);
  }
  if (name != null) {
    sc.setParameters("String_Node_Str","String_Node_Str" + name + "String_Node_Str");
  }
  if (id != null) {
    sc.setParameters("String_Node_Str",id);
  }
  if (!permittedAccounts.isEmpty()) {
    sc.setParameters("String_Node_Str",permittedAccounts.toArray());
    sc.setJoinParameters("String_Node_Str","String_Node_Str",1);
  }
 else   if (domainId != null) {
    DomainVO domain=_domainDao.findById(domainId);
    if (isRecursive) {
      sc.setJoinParameters("String_Node_Str","String_Node_Str",domain.getPath() + "String_Node_Str");
    }
 else {
      sc.setJoinParameters("String_Node_Str","String_Node_Str",domain.getPath());
    }
  }
  if (type != null) {
    sc.setParameters("String_Node_Str","String_Node_Str" + type + "String_Node_Str");
  }
  if (vmInstanceId != null) {
    sc.setParameters("String_Node_Str",vmInstanceId);
  }
  if (zoneId != null) {
    sc.setParameters("String_Node_Str",zoneId);
  }
  if (pod != null) {
    sc.setParameters("String_Node_Str",pod);
  }
  sc.setJoinParameters("String_Node_Str","String_Node_Str",VirtualMachine.Type.ConsoleProxy,VirtualMachine.Type.SecondaryStorageVm,VirtualMachine.Type.DomainRouter);
  sc.setParameters("String_Node_Str",Volume.State.Destroy);
  return _volumeDao.search(sc,searchFilter);
}