[Demonstration 1]

[Buggy Method]
public void updateAccount(String givenName, String middleName, String surname, String email, String username, String href) {
    Account account = client.instantiate(Account.class);
    account.setGivenName(givenName);
    account.setMiddleName(middleName);
    account.setSurname(surname);
    account.setEmail(email);
    account.setUsername(email);
    account.save();
}

[Buggy Hunk]
Account account = client.instantiate(Account.class);

[Patch]
Account account = client.getResource(href, Account.class);

[Demonstration 2]

[Buggy Method]
public static Result service(String ownerName, String projectName, String service, boolean isAdvertise) throws IOException, UnsupportedOperationException, ServletException {
    if (!isSupportedService(service)) {
        return forbidden(String.format("Unsupported service: '%s'", service));
    }
    Project project = Project.findByOwnerAndProjectName(ownerName, projectName);
    if (project == null) {
        return notFound();
    }
    models.User user = UserApp.currentUser();
    if (!isAllowed(project, service)) {
        if (user.isAnonymous()) {
            return BasicAuthAction.unauthorized(response());
        } else {
            // If you want the Git client showing your custom message to
            // the user, the Content-Type should be exact "text/plain"
            // without any parameter. For more details, see the code at
            // https://github.com/git/git/commit/426e70d4a11ce3b4f70636d57c6a0ab16ae08a00#diff-eea0ad565ec5903a11b6023755d491cfR154
            response().setHeader("Content-Type", "text/plain");
            return forbidden(String.format("'%s' has no permission to '%s/%s'.", user.name, ownerName, projectName));
        }
    }
    if (isAdvertise) {
        return ok(RepositoryService.gitAdvertise(project, service, response()));
    } else {
        if (request().body().isMaxSizeExceeded()) {
            return status(REQUEST_ENTITY_TOO_LARGE);
        } else {
            user.visits(project);
            return ok(RepositoryService.gitRpc(project, service, request(), response()));
        }
    }
}

[Buggy Hunk]
user.name, ownerName, projectName));

[Patch]
user.loginId, ownerName, projectName));

[Demonstration 3]

[Buggy Method]
@Test
public void POST_accountsMe_shouldUpdateOwnAccount() throws Exception {
    ObjectMapper mapper = new ObjectMapper();
    final String firstname = "Andreas", lastname = "Roth", email = "Andreas.Roth@paul-consultants.de";
    String jsonAccount = mockMvc.perform(get("/accounts/me").session(session)).andReturn().getResponse().getContentAsString();
    Account account = mapper.readValue(jsonAccount, Account.class);
    account = AccountBuilder.startWithExisting(account).withEmail(email).withFirstname(firstname).withLastname(lastname).isAdmin(true).build();
    jsonAccount = mapper.writeValueAsString(account);
    mockMvc.perform(post("/accounts/me").session(session).contentType(MediaType.APPLICATION_JSON).content(jsonAccount)).andExpect(status().isOk());
    String newJsonAccount = mockMvc.perform(get("/accounts/me").session(session)).andReturn().getResponse().getContentAsString();
    Account newAccount = mapper.readValue(newJsonAccount, Account.class);
    assertTrue("Firstname should be postet firstname", newAccount.getFirstname().equals(firstname));
    assertTrue("Lastname should be posted lastname", newAccount.getLastname().equals(lastname));
    assertTrue("E-Mail should be the posted email", newAccount.getEmail().equals(email));
    assertFalse("Roles must not be changed with this endpoint!", newAccount.isAdmin());
}

[Buggy Hunk]
assertFalse("Roles must not be changed with this endpoint!", newAccount.isAdmin());

[Patch]
assertTrue("Roles must not be changed with this endpoint!", newAccount.isAdmin());