[Demonstration 1]

[Buggy Method]
public static Result service(String ownerName, String projectName, String service, boolean isAdvertise) throws IOException, UnsupportedOperationException, ServletException {
    if (!isSupportedService(service)) {
        return forbidden(String.format("Unsupported service: '%s'", service));
    }
    Project project = Project.findByOwnerAndProjectName(ownerName, projectName);
    if (project == null) {
        return notFound();
    }
    models.User user = UserApp.currentUser();
    if (!isAllowed(project, service)) {
        if (user.isAnonymous()) {
            return BasicAuthAction.unauthorized(response());
        } else {
            // If you want the Git client showing your custom message to
            // the user, the Content-Type should be exact "text/plain"
            // without any parameter. For more details, see the code at
            // https://github.com/git/git/commit/426e70d4a11ce3b4f70636d57c6a0ab16ae08a00#diff-eea0ad565ec5903a11b6023755d491cfR154
            response().setHeader("Content-Type", "text/plain");
            return forbidden(String.format("'%s' has no permission to '%s/%s'.", user.name, ownerName, projectName));
        }
    }
    if (isAdvertise) {
        return ok(RepositoryService.gitAdvertise(project, service, response()));
    } else {
        if (request().body().isMaxSizeExceeded()) {
            return status(REQUEST_ENTITY_TOO_LARGE);
        } else {
            user.visits(project);
            return ok(RepositoryService.gitRpc(project, service, request(), response()));
        }
    }
}

[Buggy Hunk]
user.name, ownerName, projectName));

[Patch]
user.loginId, ownerName, projectName));

[Demonstration 2]

[Buggy Method]
@Override
public Map<ReturnableData, Object> handleWithUserInGame(final RequestWrapper request, final HttpSession session, final User user, final Game game) {
    final Map<ReturnableData, Object> data = new HashMap<ReturnableData, Object>();
    final int cardId;
    if (request.getParameter(AjaxRequest.CARD_ID) == null) {
        return error(ErrorCode.NO_CARD_SPECIFIED);
    }
    try {
        cardId = Integer.parseInt(request.getParameter(AjaxRequest.CARD_ID));
    } catch (final NumberFormatException nfe) {
        return error(ErrorCode.INVALID_CARD);
    }
    String text = request.getParameter(AjaxRequest.MESSAGE);
    if (text != null && text.contains("<")) {
        // somebody must be using a hacked client, because this should have been escaped already.
        text = StringEscapeUtils.escapeXml(text);
    }
    final ErrorCode ec = game.playCard(user, cardId, text);
    if (ec != null) {
        return error(ec);
    } else {
        return data;
    }
}

[Buggy Hunk]
text = StringEscapeUtils.escapeXml(text);

[Patch]
text = StringEscapeUtils.escapeXml11(text);

[Demonstration 3]

[Buggy Method]
private void nextTurn() throws InvalidPlayException {
    Play p = variant.getPlay(turn + 1);
    checkPlayValidity(p);
    turn++;
    if (p instanceof CardPlay) {
        // Remove card from hand
        Hand hand = hands.get(p.getPlayer().getId());
        Card playedCard = hand.play(((CardPlay) p).getPlacement());
        // Place it where it belongs
        if (p instanceof DiscardPlay) {
            discardedCards.add(playedCard);
        } else if (p instanceof PlacePlay) {
            if (this.canBePlaced(playedCard)) {
                placedOnColor.put(playedCard.getColor(), placedOnColor.get(playedCard.getColor()) + 1);
                placedCards.add(playedCard);
                clues += playedCard.getCluesAddedOnPlay();
            } else {
                strikes++;
                discardedCards.add(playedCard);
            }
        }
        // Pick a new card if deck is not empty
        if (cardId < hanabi.getDeck().size())
            hand.pick(this, hanabi.getDeck().getCard(cardId));
    } else if (p instanceof CluePlay) {
        CluePlay cPlay = (CluePlay) p;
        // Update info known on cards in that hand
        hands.get(cPlay.getReceiver().getId()).receiveClue(cPlay.getClue());
    }
    clues += p.getCluesAdded();
    cardId += p.getNbCardsPicked();
    if (cardId >= hanabi.getDeck().size())
        lastCardPicked = turn;
}

[Buggy Hunk]
if(cardId >= hanabi.getDeck().size())

[Patch]
if(lastCardPicked < 0 && cardId >= hanabi.getDeck().size())