Program: 49528
Project: 49528
Buggy source:
/** 
 * Create a Consumer. NOTE: Opening this method up to everyone, as we have nothing we can reliably verify in the method signature. Instead we have to figure out what owner this consumer is destined for (due to backward compatability with existing clients which do not specify an owner during registration), and then check the access to the specified owner in the method itself.
 * @param consumer Consumer metadata
 * @return newly created Consumer
 * @throws BadRequestException generic exception type for web services Weare calling this "registerConsumer" in the api discussions
 */
@POST @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) @SecurityHole(noAuth=true) public Consumer create(Consumer consumer,@Context Principal principal,@QueryParam("String_Node_Str") String userName,@QueryParam("String_Node_Str") String ownerKey,@QueryParam("String_Node_Str") String activationKeys) throws BadRequestException {
  Set<String> keyStrings=splitKeys(activationKeys);
  if ((principal instanceof NoAuthPrincipal) && (keyStrings.size() == 0)) {
    throw new ForbiddenException(i18n.tr("String_Node_Str"));
  }
  if (keyStrings.size() > 0) {
    if (ownerKey == null) {
      throw new BadRequestException(i18n.tr("String_Node_Str"));
    }
    if (userName != null) {
      throw new BadRequestException(i18n.tr("String_Node_Str"));
    }
  }
  if (!isConsumerNameValid(consumer.getName())) {
    throw new BadRequestException(i18n.tr("String_Node_Str"));
  }
  if (consumer.getName().indexOf('#') == 0) {
    throw new BadRequestException(i18n.tr("String_Node_Str"));
  }
  if (userName == null) {
    userName=principal.getUsername();
  }
  Owner owner=setupOwner(principal,ownerKey);
  List<ActivationKey> keys=new ArrayList<ActivationKey>();
  if (keyStrings.size() > 0) {
    for (    String keyString : keyStrings) {
      ActivationKey key=findKey(keyString,owner);
      keys.add(key);
    }
  }
  ConsumerType type=lookupConsumerType(consumer.getType().getLabel());
  if (type.isType(ConsumerTypeEnum.PERSON)) {
    if (keys.size() > 0) {
      throw new BadRequestException(i18n.tr("String_Node_Str" + "String_Node_Str"));
    }
    verifyPersonConsumer(consumer,type,owner,userName);
  }
  if (userName != null) {
    consumer.setUsername(userName);
  }
  consumer.setOwner(owner);
  consumer.setType(type);
  consumer.setCanActivate(subAdapter.canActivateSubscription(consumer));
  if (log.isDebugEnabled()) {
    log.debug("String_Node_Str" + type.getLabel());
    log.debug("String_Node_Str");
    log.debug(consumer.getFacts());
    for (    String key : consumer.getFacts().keySet()) {
      log.debug("String_Node_Str" + key + "String_Node_Str"+ consumer.getFact(key));
    }
    log.debug("String_Node_Str");
    for (    ActivationKey activationKey : keys) {
      log.debug("String_Node_Str" + activationKey.getName());
    }
  }
  for (  ConsumerInstalledProduct p : consumer.getInstalledProducts()) {
    p.setConsumer(consumer);
  }
  try {
    consumer=consumerCurator.create(consumer);
    IdentityCertificate idCert=generateIdCert(consumer,false);
    consumer.setIdCert(idCert);
    sink.emitConsumerCreated(consumer);
    for (    ActivationKey ak : keys) {
      for (      ActivationKeyPool akp : ak.getPools()) {
        List<Entitlement> entitlements=null;
        String poolId=Util.assertNotNull(akp.getPool().getId(),i18n.tr("String_Node_Str"));
        entitlements=entitler.bindByPool(poolId,consumer,akp.getQuantity().intValue());
        entitler.sendEvents(entitlements);
      }
    }
    return consumer;
  }
 catch (  CandlepinException ce) {
    throw ce;
  }
catch (  Exception e) {
    log.error("String_Node_Str",e);
    e.printStackTrace();
    throw new BadRequestException(i18n.tr("String_Node_Str",consumer));
  }
}

Fixed version (ground truth):
/** 
 * Create a Consumer. NOTE: Opening this method up to everyone, as we have nothing we can reliably verify in the method signature. Instead we have to figure out what owner this consumer is destined for (due to backward compatability with existing clients which do not specify an owner during registration), and then check the access to the specified owner in the method itself.
 * @param consumer Consumer metadata
 * @return newly created Consumer
 * @throws BadRequestException generic exception type for web services Weare calling this "registerConsumer" in the api discussions
 */
@POST @Consumes(MediaType.APPLICATION_JSON) @Produces(MediaType.APPLICATION_JSON) @SecurityHole(noAuth=true) public Consumer create(Consumer consumer,@Context Principal principal,@QueryParam("String_Node_Str") String userName,@QueryParam("String_Node_Str") String ownerKey,@QueryParam("String_Node_Str") String activationKeys) throws BadRequestException {
  Set<String> keyStrings=splitKeys(activationKeys);
  if ((principal instanceof NoAuthPrincipal) && (keyStrings.size() == 0)) {
    throw new ForbiddenException(i18n.tr("String_Node_Str"));
  }
  if (keyStrings.size() > 0) {
    if (ownerKey == null) {
      throw new BadRequestException(i18n.tr("String_Node_Str"));
    }
    if (userName != null) {
      throw new BadRequestException(i18n.tr("String_Node_Str"));
    }
  }
  if (!isConsumerNameValid(consumer.getName())) {
    throw new BadRequestException(i18n.tr("String_Node_Str"));
  }
  if (consumer.getName().indexOf('#') == 0) {
    throw new BadRequestException(i18n.tr("String_Node_Str"));
  }
  if (userName == null) {
    userName=principal.getUsername();
  }
  Owner owner=setupOwner(principal,ownerKey);
  List<ActivationKey> keys=new ArrayList<ActivationKey>();
  if (keyStrings.size() > 0) {
    for (    String keyString : keyStrings) {
      ActivationKey key=findKey(keyString,owner);
      keys.add(key);
    }
  }
  ConsumerType type=lookupConsumerType(consumer.getType().getLabel());
  if (type.isType(ConsumerTypeEnum.PERSON)) {
    if (keys.size() > 0) {
      throw new BadRequestException(i18n.tr("String_Node_Str" + "String_Node_Str"));
    }
    verifyPersonConsumer(consumer,type,owner,userName);
  }
  if (userName != null) {
    consumer.setUsername(userName);
  }
  consumer.setOwner(owner);
  consumer.setType(type);
  consumer.setCanActivate(subAdapter.canActivateSubscription(consumer));
  if (log.isDebugEnabled()) {
    log.debug("String_Node_Str" + type.getLabel());
    log.debug("String_Node_Str");
    log.debug(consumer.getFacts());
    if (consumer.getFacts() != null) {
      for (      String key : consumer.getFacts().keySet()) {
        log.debug("String_Node_Str" + key + "String_Node_Str"+ consumer.getFact(key));
      }
    }
    log.debug("String_Node_Str");
    for (    ActivationKey activationKey : keys) {
      log.debug("String_Node_Str" + activationKey.getName());
    }
  }
  if (consumer.getInstalledProducts() != null) {
    for (    ConsumerInstalledProduct p : consumer.getInstalledProducts()) {
      p.setConsumer(consumer);
    }
  }
  try {
    consumer=consumerCurator.create(consumer);
    IdentityCertificate idCert=generateIdCert(consumer,false);
    consumer.setIdCert(idCert);
    sink.emitConsumerCreated(consumer);
    for (    ActivationKey ak : keys) {
      for (      ActivationKeyPool akp : ak.getPools()) {
        List<Entitlement> entitlements=null;
        String poolId=Util.assertNotNull(akp.getPool().getId(),i18n.tr("String_Node_Str"));
        entitlements=entitler.bindByPool(poolId,consumer,akp.getQuantity().intValue());
        entitler.sendEvents(entitlements);
      }
    }
    return consumer;
  }
 catch (  CandlepinException ce) {
    throw ce;
  }
catch (  Exception e) {
    log.error("String_Node_Str",e);
    e.printStackTrace();
    throw new BadRequestException(i18n.tr("String_Node_Str",consumer));
  }
}