[Demonstration 1]

[Buggy Method]
public Result save() {
    Form<SignUpForm> boundForm = signUpForm.bindFromRequest();
    SignUpForm singUp = boundForm.get();
    if (User.findByEmail(singUp.email) != null) {
        flash(ERROR_MESSAGE, "Account already linked to given email!");
        return badRequest(signup.render(boundForm));
    }
    if (!singUp.password.equals(singUp.confirmPassword)) {
        flash(ERROR_MESSAGE, "Passwords do not match!");
        return badRequest(signup.render(boundForm));
    }
    if (UserValidator.isPasswordValid(boundForm.field("password").value())[0] == UserController.ERROR_MESSAGE) {
        flash(UserValidator.isPasswordValid(boundForm.field("password").value())[0], UserValidator.isPasswordValid(boundForm.field("password").value())[1]);
        return badRequest(signup.render(boundForm));
    }
    User u = User.newUser(singUp);
    u.setToken(UUID.randomUUID().toString());
    u.update();
    // Sending Email To user
    String host = url + "validate/" + u.getToken();
    MailHelper.send(u.email, host);
    return redirect(routes.Application.index());
}

[Buggy Hunk]
return redirect(routes.Application.index());

[Patch]
return ok(index.render(new ArrayList<Place>()));

[Demonstration 2]

[Buggy Method]
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
    String serverName = req.getServerName();
    int serverPort = req.getServerPort();
    // http://localhost:8888/oauth2/
    REDIRECT_URI = "http://" + serverName + (serverPort != 80 ? ":" + serverPort : "") + "/oauth2/";
    // String pathInfo = req.getPathInfo();
    if (req.getPathInfo().contains("logout")) {
        Cookie[] cookies = req.getCookies();
        if (cookies != null)
            for (int i = 0; i < cookies.length; i++) {
                cookies[i].setValue("");
                cookies[i].setPath("/");
                cookies[i].setMaxAge(0);
                resp.addCookie(cookies[i]);
            }
        String redirect_uri = req.getParameter(REDIRECT_URI_NAME);
        try {
            resp.sendRedirect(redirect_uri);
        } catch (IOException e) {
            e.printStackTrace();
        }
    } else {
        // get the state token from the request
        String requestCsfr = req.getParameter("state");
        String sessionCsfr = (String) req.getSession().getAttribute("state");
        if (requestCsfr != null && sessionCsfr != null && requestCsfr.compareTo(sessionCsfr) == 0) {
            // we're coming back from valid login
            // Exchange code for access token and ID token
            String code = req.getParameter(RESPONSE_TYPE);
            String as = (String) req.getSession().getAttribute("authorization_endpoint");
            String redirect_uri = (String) req.getSession().getAttribute(REDIRECT_URI_NAME);
            String email = null;
            switch(as) {
                case GOOGLE_AUTHORIZATION_ENDPOINT:
                    JsonObject token = getGoogleToken(code);
                    email = token.get("email").toString();
                    break;
                case FACEBOOK_AUTHORIZATION_ENDPOINT:
                    String facebookAccessToken = getFacebookAccessToken(code);
                    email = getFacebookEmail(facebookAccessToken);
                    break;
            }
            try {
                // stash the email somewhere useful
                req.getSession().setAttribute("email", email);
                resp.sendRedirect(redirect_uri);
            } catch (IOException e) {
                e.printStackTrace();
            }
            return;
        } else if (requestCsfr == null) {
            // new login flow
            String openid_identifier = (String) req.getParameter("openid_identifier");
            String url = null;
            String csfrToken = getCsfrToken();
            // save the state/csfr in the session
            req.getSession().setAttribute("state", csfrToken);
            try {
                switch(openid_identifier) {
                    case GOOGLE_AUTHORIZATION_ENDPOINT:
                        req.getSession().setAttribute("authorization_endpoint", GOOGLE_AUTHORIZATION_ENDPOINT);
                        url = getGoogleAuthorizationUrl(csfrToken);
                        break;
                    case FACEBOOK_AUTHORIZATION_ENDPOINT:
                        req.getSession().setAttribute("authorization_endpoint", FACEBOOK_AUTHORIZATION_ENDPOINT);
                        url = getFacebookAuthorizationUrl(csfrToken);
                        break;
                    default:
                        openid_identifier = "";
                        break;
                }
            } catch (UnsupportedEncodingException e1) {
                e1.printStackTrace();
            }
            // save the location to redirect back to in the session
            String reredirect_uri = req.getParameter(REDIRECT_URI_NAME);
            req.getSession().setAttribute(REDIRECT_URI_NAME, reredirect_uri);
            try {
                resp.sendRedirect(url);
                return;
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }
}

[Buggy Hunk]
email = token.get("email").toString();

[Patch]
email = token.get("email").toString().replace("\"", "");

[Demonstration 3]

[Buggy Method]
@RequestMapping
public String welcome(Model model) {
    if (!newsService.getAllNews().isEmpty()) {
        model.addAttribute("news", newsService.getAllNews());
    }
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (!(auth.getPrincipal() instanceof AnonymousAuthenticationToken)) {
        model.addAttribute("user", getPrincipal());
        System.out.println(auth.getPrincipal().toString());
    } else {
        model.addAttribute("user", null);
    }
    return "home";
}

[Buggy Hunk]
if( !(auth.getPrincipal() instanceof AnonymousAuthenticationToken)){

[Patch]
if( !(auth instanceof AnonymousAuthenticationToken)){