nus-yam/ex-repair huggingface dataset:
Program: 40
Project: VUL4J
Buggy source:
package org.cloudfoundry.identity.uaa.security;import org.apache.commons.io.IOUtils;import org.cloudfoundry.identity.uaa.scim.ScimUser;import org.cloudfoundry.identity.uaa.scim.ScimUserProvisioning;import org.cloudfoundry.identity.uaa.scim.exception.ScimResourceNotFoundException;import org.cloudfoundry.identity.uaa.util.JsonUtils;import org.cloudfoundry.identity.uaa.util.UaaUrlUtils;import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;import javax.servlet.http.HttpServletRequest;import java.io.IOException;public class ScimUserSelfUpdateAllowed {    public static final int USER_ID_PATH_PARAMETER_INDEX = 1;    private ScimUserProvisioning scimUserProvisioning;    public ScimUserSelfUpdateAllowed(ScimUserProvisioning scimUserProvisioning) {        this.scimUserProvisioning = scimUserProvisioning;    }    public boolean isAllowed(HttpServletRequest request) throws IOException {        String requestBody = IOUtils.toString(request.getReader());        ScimUser scimUserFromRequest = JsonUtils.readValue(requestBody, ScimUser.class);        String id = UaaUrlUtils.extractPathVariableFromUrl(USER_ID_PATH_PARAMETER_INDEX, UaaUrlUtils.getRequestPath(request));        String zoneId = IdentityZoneHolder.get().getId();        ScimUser scimUserFromDb;        try {            scimUserFromDb = scimUserProvisioning.retrieve(id, zoneId);        } catch (ScimResourceNotFoundException e) {            return true;        }        if (!scimUserFromDb.getPrimaryEmail().equals(scimUserFromRequest.getPrimaryEmail())) {            return false;        }	<START_BUG> <END_BUG>        if (!scimUserFromDb.getUserName().equals(scimUserFromRequest.getUserName())) {            return false;        }        if (scimUserFromDb.isVerified() != scimUserFromRequest.isVerified()) {            return false;        }        if (scimUserFromDb.isActive() != (scimUserFromRequest.isActive())) {            return false;        }        if (!scimUserFromDb.getOrigin().equals(scimUserFromRequest.getOrigin())) {            return false;        }        return true;    }}


Fixed version (ground truth):
if (!scimUserFromDb.getEmails().containsAll(scimUserFromRequest.getEmails())) { return false; }
Program: 43
Project: VUL4J
Buggy source:
//******************************************************************************* * Copyright (c) 2015 Eclipse RDF4J contributors, Aduna, and others. * All rights reserved. This program and the accompanying materials * are made available under the terms of the Eclipse Distribution License v1.0 * which accompanies this distribution, and is available at * http: *******************************************************************************//package org.eclipse.rdf4j.common.io;import java.io.File;import java.io.IOException;import java.io.InputStream;import java.util.Arrays;import java.util.Enumeration;import java.util.zip.ZipEntry;import java.util.zip.ZipFile;//** * Zip-related utilities. *//public class ZipUtil {	//**	 * Magic number for ZIP files (4 bytes: <tt>0x04034b50<//tt>).	 *//	private final static byte MAGIC_NUMBER[] = { (byte)0x50, (byte)0x4B, (byte)0x03, (byte)0x04 };	//**	 * Test if an input stream is a zip input stream by checking the "magic number"	 * 	 * @param in input stream	 * @return true if start of input stream matches magic number	 * @throws IOException 	 *//	public static boolean isZipStream(InputStream in) throws IOException {		in.mark(MAGIC_NUMBER.length);		byte[] fileHeader = IOUtil.readBytes(in, MAGIC_NUMBER.length);		in.reset();		return Arrays.equals(MAGIC_NUMBER, fileHeader);	}	//**	 * Extract the contents of a zipfile to a directory.	 * 	 * @param zipFile	 *        the zip file to extract	 * @param destDir	 *        the destination directory	 * @throws IOException	 *         when something untoward happens during the extraction process	 *//	public static void extract(File zipFile, File destDir) throws IOException {		try (ZipFile zf = new ZipFile(zipFile)) {			extract(zf, destDir);		}	}	//**	 * Extract the contents of a zipfile to a directory.	 * 	 * @param zipFile	 *        the zip file to extract	 * @param destDir	 *        the destination directory	 * @throws IOException	 *         when something untoward happens during the extraction process	 *//	public static void extract(ZipFile zipFile, File destDir) throws IOException {		assert destDir.isDirectory();		Enumeration<? extends ZipEntry> entries = zipFile.entries();		while (entries.hasMoreElements()) {			ZipEntry entry = entries.nextElement();			writeEntry(zipFile, entry, destDir);		}	}	//**	 * Write an entry to a zip file.	 * 	 * @param zipFile	 *        the zip file to read from	 * @param entry	 *        the entry to process	 * @param destDir	 *        the file to write to	 * @throws IOException	 *         if the entry could not be processed	 *//	public static void writeEntry(ZipFile zipFile, ZipEntry entry, File destDir) throws IOException {		File outFile = new File(destDir, entry.getName());		<START_BUG> <END_BUG>						if (entry.isDirectory()) {			outFile.mkdirs();		} else {			outFile.getParentFile().mkdirs();			try (InputStream in = zipFile.getInputStream(entry)) {				IOUtil.writeStream(in, outFile);			}		}	}}


Fixed version (ground truth):
if (! outFile.getCanonicalFile().toPath().startsWith(destDir.toPath())) { throw new IOException("Zip entry outside destination directory: " + entry.getName()); }
Program: 73
Project: VUL4J
Buggy source:
//* * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * *      https: * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. *//package org.springframework.security.authentication.encoding;import java.util.Locale;//** * <p> * Plaintext implementation of PasswordEncoder. * <//p> * <P> * As callers may wish to extract the password and salts separately from the encoded * password, the salt must not contain reserved characters (specifically '{' and '}'). * <//p> * * @author colin sampaleanu * @author Ben Alex * @deprecated This class will be removed in Spring Security 5. For passivity switch to * {@link org.springframework.security.crypto.password.NoOpPasswordEncoder}. *//@Deprecatedpublic class PlaintextPasswordEncoder extends BasePasswordEncoder {			private boolean ignorePasswordCase = false;			public String encodePassword(String rawPass, Object salt) {		return mergePasswordAndSalt(rawPass, salt, true);	}	public boolean isIgnorePasswordCase() {		return ignorePasswordCase;	}	public boolean isPasswordValid(String encPass, String rawPass, Object salt) {		<START_BUG> <END_BUG>		String pass1 = encPass + "";								String pass2 = mergePasswordAndSalt(rawPass, salt, false);		if (ignorePasswordCase) {									pass1 = pass1.toLowerCase(Locale.ENGLISH);			pass2 = pass2.toLowerCase(Locale.ENGLISH);		}		return PasswordEncoderUtils.equals(pass1, pass2);	}	//**	 * Demerges the previously {@link #encodePassword(String, Object)}<code>String<//code>.	 * <P>	 * The resulting array is guaranteed to always contain two elements. The first is the	 * password, and the second is the salt.	 * <//p>	 * <P>	 * Throws an exception if <code>null<//code> or an empty <code>String<//code> is passed	 * to the method.	 * <//p>	 *	 * @param password from {@link #encodePassword(String, Object)}	 *	 * @return an array containing the password and salt	 *//	public String[] obtainPasswordAndSalt(String password) {		return demergePasswordAndSalt(password);	}	//**	 * Indicates whether the password comparison is case sensitive.	 * <P>	 * Defaults to <code>false<//code>, meaning an exact case match is required.	 * <//p>	 *	 * @param ignorePasswordCase set to <code>true<//code> for less stringent comparison	 *//	public void setIgnorePasswordCase(boolean ignorePasswordCase) {		this.ignorePasswordCase = ignorePasswordCase;	}}


Fixed version (ground truth):
if (encPass == null) { return false; }
Program: 74
Project: VUL4J
Buggy source:
//* * Copyright 2002-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * *      https: * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. *//package org.springframework.security.core.token;import java.io.InputStream;import java.security.SecureRandom;import org.springframework.beans.factory.FactoryBean;import org.springframework.core.io.Resource;import org.springframework.util.Assert;import org.springframework.util.FileCopyUtils;//** * Creates a {@link SecureRandom} instance. * * @author Ben Alex * @since 2.0.1 *//public class SecureRandomFactoryBean implements FactoryBean<SecureRandom> {	private String algorithm = "SHA1PRNG";	private Resource seed;	public SecureRandom getObject() throws Exception {		SecureRandom rnd = SecureRandom.getInstance(algorithm);						<START_BUG> <END_BUG>		if (seed != null) {						byte[] seedBytes = FileCopyUtils.copyToByteArray(seed.getInputStream());			rnd.setSeed(seedBytes);		}		else{		rnd.nextBytes(new byte[1]);		}		return rnd;	}	public Class<SecureRandom> getObjectType() {		return SecureRandom.class;	}	public boolean isSingleton() {		return false;	}	//**	 * Allows the Pseudo Random Number Generator (PRNG) algorithm to be nominated.	 * Defaults to "SHA1PRNG".	 *	 * @param algorithm to use (mandatory)	 *//	public void setAlgorithm(String algorithm) {		Assert.hasText(algorithm, "Algorithm required");		this.algorithm = algorithm;	}	//**	 * Allows the user to specify a resource which will act as a seed for the	 * {@link SecureRandom} instance. Specifically, the resource will be read into an	 * {@link InputStream} and those bytes presented to the	 * {@link SecureRandom#setSeed(byte[])} method. Note that this will simply supplement,	 * rather than replace, the existing seed. As such, it is always safe to set a seed	 * using this method (it never reduces randomness).	 *	 * @param seed to use, or <code>null<//code> if no additional seeding is needed	 *//	public void setSeed(Resource seed) {		this.seed = seed;	}}


Fixed version (ground truth):
rnd.nextBytes(new byte[1]);