[Demonstration 1]

[Buggy Method]
public String apply(Player player, String text, Function<String, Placeholder> finder) {
    Matcher matcher = PLACEHOLDER_PATTERN.matcher(text);
    StringBuffer res = new StringBuffer();
    while (matcher.find()) {
        String str = matcher.group(1);
        String replacement = exec(player, str, finder);
        if (replacement != null)
            matcher.appendReplacement(res, replacement);
    }
    matcher.appendTail(res);
    return res.toString();
}

[Buggy Hunk]
matcher.appendReplacement(res, replacement);

[Patch]
matcher.appendReplacement(res, Matcher.quoteReplacement(replacement));

[Demonstration 2]

[Buggy Method]
public String parseLinks(String text, SQLiteConnector sqLiteConnector) {
    Pattern pattern = Pattern.compile("<a href[^\\n\\r]+article.+?id=(\\d+).+?>(.+?)</a>");
    Matcher matcher = pattern.matcher(text);
    String result = text;
    StringBuffer stringBuffer = new StringBuffer();
    while (matcher.find()) {
        parsedLinksCount++;
        int id = Integer.parseInt(matcher.group(1));
        String linkText = matcher.group(2);
        try {
            if (sqLiteConnector.getContentRow(id).next()) {
                matcher.appendReplacement(stringBuffer, "<a onClick=\"" + id + "\">" + linkText + "</a>");
            } else
                matcher.appendReplacement(stringBuffer, linkText);
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
    matcher.appendTail(stringBuffer);
    if (stringBuffer != null)
        result = stringBuffer.toString();
    return result;
}

[Buggy Hunk]
matcher.appendReplacement(stringBuffer, "<a onClick=\"" + id + "\">" + linkText + "</a>");

[Patch]
matcher.appendReplacement(stringBuffer, "<a onClick=\"loadPage(" + id + ")\" href=\"#\">" + linkText + "</a>");

[Demonstration 3]

[Buggy Method]
public static Result service(String ownerName, String projectName, String service, boolean isAdvertise) throws IOException, UnsupportedOperationException, ServletException {
    if (!isSupportedService(service)) {
        return forbidden(String.format("Unsupported service: '%s'", service));
    }
    Project project = Project.findByOwnerAndProjectName(ownerName, projectName);
    if (project == null) {
        return notFound();
    }
    models.User user = UserApp.currentUser();
    if (!isAllowed(project, service)) {
        if (user.isAnonymous()) {
            return BasicAuthAction.unauthorized(response());
        } else {
            // If you want the Git client showing your custom message to
            // the user, the Content-Type should be exact "text/plain"
            // without any parameter. For more details, see the code at
            // https://github.com/git/git/commit/426e70d4a11ce3b4f70636d57c6a0ab16ae08a00#diff-eea0ad565ec5903a11b6023755d491cfR154
            response().setHeader("Content-Type", "text/plain");
            return forbidden(String.format("'%s' has no permission to '%s/%s'.", user.name, ownerName, projectName));
        }
    }
    if (isAdvertise) {
        return ok(RepositoryService.gitAdvertise(project, service, response()));
    } else {
        if (request().body().isMaxSizeExceeded()) {
            return status(REQUEST_ENTITY_TOO_LARGE);
        } else {
            user.visits(project);
            return ok(RepositoryService.gitRpc(project, service, request(), response()));
        }
    }
}

[Buggy Hunk]
user.name, ownerName, projectName));

[Patch]
user.loginId, ownerName, projectName));