[Demonstration 1]

[Buggy Method]
public Train createReverseTrain(String id, String number, int time, Train copiedTrain) {
    // create train
    Train train = copiedTrain.getDiagram().getPartFactory().createTrain(id);
    train.setNumber(number);
    train.setType(copiedTrain.getType());
    train.setDescription(copiedTrain.getDescription());
    train.setTopSpeed(copiedTrain.getTopSpeed());
    train.getAttributes().add(copiedTrain.getAttributes());
    // get original intervals in reverse order
    LinkedList<TimeInterval> reverseIntervals = new LinkedList<>();
    for (TimeInterval interval : copiedTrain.getTimeIntervalList()) {
        reverseIntervals.addFirst(interval);
    }
    int currentTime = time;
    // create time intervals
    for (TimeInterval originalInterval : reverseIntervals) {
        TimeInterval interval = null;
        if (originalInterval.isNodeOwner()) {
            interval = new TimeInterval(IdGenerator.getInstance().getId(), train, originalInterval.getOwner(), currentTime, currentTime + originalInterval.getLength(), null);
        } else {
            interval = new TimeInterval(IdGenerator.getInstance().getId(), train, originalInterval.getOwner(), 0, 0, originalInterval.getSpeedLimit(), originalInterval.getDirection().reverse(), null, originalInterval.getAddedTime());
        }
        currentTime = interval.getEnd();
        train.addInterval(interval);
    }
    train.recalculate();
    train.assignEmptyTracks();
    return train;
}

[Buggy Hunk]
train.getAttributes().add(copiedTrain.getAttributes());

[Patch]
copyAttributes(copiedTrain, train);

[Demonstration 2]

[Buggy Method]
@SuppressWarnings("unchecked")
void doRevert() {
    loadMembers((ArrayList<RelationMemberDescription>) getArguments().getSerializable("members"));
    setIcons();
}

[Buggy Hunk]
loadMembers((ArrayList<RelationMemberDescription>)getArguments().getSerializable("members"));

[Patch]
loadMembers((ArrayList<RelationMemberDescription>)getArguments().getSerializable(MEMBERS_KEY));

[Demonstration 3]

[Buggy Method]
@POST
@PermitAll
public Response authenticate(@HeaderParam("user-agent") String userAgent, UserDTO user) throws OrgApiException {
    if (StringUtils.isEmpty(user.getUserEmail()) || StringUtils.isEmpty(user.getPassword())) {
        throw new OrgApiInvalidRequestException("Authentication request has incomplete credentials");
    }
    UserService userService = factory.newUserService(securityContext);
    UserDTO foundUser = userService.getUserByName(user.getUserEmail());
    if (foundUser == null) {
        OrgApiLogger.getRestLogger().warn("Attempted login by non-existent user: " + user.getUserEmail());
        throw new OrgApiSecurityException("Invalid login credentials");
    }
    OrgService orgService = factory.newOrgService(securityContext);
    TokenService tokenService = factory.newTokenService(securityContext);
    if (!HashingUtils.verifyBCryptHash(user.getPassword(), foundUser.getPassword())) {
        OrgApiLogger.getRestLogger().warn("Attempted login with invalid password. User: " + user.getUserEmail());
        throw new OrgApiSecurityException("Invalid login credentials");
    }
    //If a NumberFormatException ever happens here, the property is invalid
    int refreshExpHrs = Integer.parseInt(ServerCore.getProperty(ServerProps.REFRESH_MAX_EXP_HRS));
    LocalDateTime expiration = LocalDateTime.now().plusHours(refreshExpHrs);
    String userAgentHash = RefreshTokenUtil.generateRefreshTokenHash(foundUser.getUserEmail(), userAgent);
    RefreshTokenDTO refreshToken = new RefreshTokenDTO(foundUser.getElementId(), foundUser.getOrgId(), userAgentHash, expiration);
    refreshToken = tokenService.addRefreshToken(refreshToken);
    OrgDTO foundOrg = orgService.getOrg(foundUser.getOrgId());
    if (foundOrg == null && !foundUser.getRoles().contains(Role.MASTER)) {
        throw new OrgApiSecurityException("User is not assigned to an org and doesn't have master access");
    }
    String token = JWTUtil.generateNewToken(refreshToken.getElementId(), foundUser.getUserEmail(), foundOrg != null ? foundOrg.getOrgName() : "", foundUser.getElementId(), foundOrg != null ? foundOrg.getElementId() : 0, foundOrg != null ? foundOrg.getSchemaName() : SchemaManager.DEFAULT_APP_SCHEMA_NAME, foundUser.getRoles());
    return Response.ok().header(HttpHeaders.AUTHORIZATION, JWTUtil.BEARER_PREFIX + token).build();
}

[Buggy Hunk]
.header(HttpHeaders.AUTHORIZATION, JWTUtil.BEARER_PREFIX + token)

[Patch]
.header(HttpHeaders.AUTHORIZATION, JWTUtil.BEARER_PREFIX + " " + token)