[Demonstration 1]

[Buggy Method]
public String authenticateUser(String username, String password) {
    String userName = username;
    final String[] parts = username.split("@", 2);
    if (parts.length > 1) {
        String email = parts[0] + "@" + parts[1];
        email = email.toLowerCase();
        Log.debug("OfMeetAzure login " + email);
        if (!authenticateByAzureAD(email, password)) {
            Log.error("access denied, unknown (user@domain) " + email);
            return parts[0];
        }
        userName = parts[0] + "." + parts[1];
        User user = null;
        try {
            user = userManager.getUser(userName);
        } catch (UserNotFoundException e) {
            try {
                user = userManager.createUser(userName, password, givenName + " " + familyName, email);
                updateDomainGroup(userName, parts[1], givenName + " " + familyName);
            } catch (Exception e1) {
                Log.error("access denied, cannot create username (user.domain) " + userName, e1);
                return userName;
            }
        }
        user.setPassword(accessToken);
    }
    return userName;
}

[Buggy Hunk]
userName = parts[0] + "." + parts[1];

[Patch]
userName = (parts[0] + "_" + parts[1]).replaceAll("\\.", "_");

[Demonstration 2]

[Buggy Method]
public User validateLogin(String _username, String _password) throws SQLException {
    String query = "SELECT * FROM users WHERE username = ? AND password = ?";
    PreparedStatement preparedStatement = conn.prepareStatement(query);
    preparedStatement.setString(1, _username);
    preparedStatement.setString(2, _password);
    ResultSet res = preparedStatement.executeQuery();
    /* Validation Successful. Create user object */
    if (res.next()) {
        int userId = res.getInt(1);
        String firstName = res.getString(2);
        String lastName = res.getString(3);
        String username = res.getString(4);
        String password = res.getString(5);
        String email = res.getString(6);
        String userType = res.getString(8);
        return new User(userId, firstName, lastName, username, password, userType, email);
    }
    /* Invalid username || password */
    return null;
}

[Buggy Hunk]
return new User(userId, firstName, lastName, username, password, userType, email);

[Patch]
return new User(userId, firstName, lastName, username, password, email, userType);

[Demonstration 3]

[Buggy Method]
@Override
public void doPost(HttpServletRequest req, HttpServletResponse resp) {
    try {
        String email = req.getParameter("email");
        String password = req.getParameter("password");
        if (DatastoreUtils.checkUserCredentials(email, password)) {
            HttpSession session = req.getSession(true);
            session.setAttribute("user", DatastoreUtils.getUser(email));
            resp.getWriter().print("success");
        } else
            resp.getWriter().print("fail");
    } catch (Exception e) {
        e.printStackTrace();
    }
}

[Buggy Hunk]
session.setAttribute("user", DatastoreUtils.getUser(email));

[Patch]
session.setAttribute("user", email);