[Demonstration 1]

[Buggy Method]
public static Request resetPassword(Request req, Response res) {
    String inputEmail = req.queryParams("email");
    String inputResetKey = req.queryParams("password-reset-key");
    String inputPassword = req.queryParams("password");
    String inputPasswordConfirmation = req.queryParams("password-confirmation");
    if (!inputPassword.equals(inputPasswordConfirmation)) {
        try {
            GenericData data = new GenericData();
            data.put("username", inputEmail);
            data.put("resetKey", inputResetKey);
            data.put("newPassword", inputPassword);
            // reset password request
            HttpResponse response = preparePostRequest(OF_USERS_API_URL + "reset-password", data).execute();
            if (response.isSuccessStatusCode()) {
                req.session().attribute("flash_messages", new String[] { "The password has been changed." });
            }
        } catch (IOException e) {
            //TODO
            e.printStackTrace();
            req.session().attribute("flash_messages", new String[] { "An error occurred. Please try again later." });
        }
    } else {
        req.session().attribute("flash_messages", new String[] { "The passwords don't match." });
    }
    return req;
}

[Buggy Hunk]
if (!inputPassword.equals(inputPasswordConfirmation)) {

[Patch]
if (inputPassword.equals(inputPasswordConfirmation)) {

[Demonstration 2]

[Buggy Method]
public static Result service(String ownerName, String projectName, String service, boolean isAdvertise) throws IOException, UnsupportedOperationException, ServletException {
    if (!isSupportedService(service)) {
        return forbidden(String.format("Unsupported service: '%s'", service));
    }
    Project project = Project.findByOwnerAndProjectName(ownerName, projectName);
    if (project == null) {
        return notFound();
    }
    models.User user = UserApp.currentUser();
    if (!isAllowed(project, service)) {
        if (user.isAnonymous()) {
            return BasicAuthAction.unauthorized(response());
        } else {
            // If you want the Git client showing your custom message to
            // the user, the Content-Type should be exact "text/plain"
            // without any parameter. For more details, see the code at
            // https://github.com/git/git/commit/426e70d4a11ce3b4f70636d57c6a0ab16ae08a00#diff-eea0ad565ec5903a11b6023755d491cfR154
            response().setHeader("Content-Type", "text/plain");
            return forbidden(String.format("'%s' has no permission to '%s/%s'.", user.name, ownerName, projectName));
        }
    }
    if (isAdvertise) {
        return ok(RepositoryService.gitAdvertise(project, service, response()));
    } else {
        if (request().body().isMaxSizeExceeded()) {
            return status(REQUEST_ENTITY_TOO_LARGE);
        } else {
            user.visits(project);
            return ok(RepositoryService.gitRpc(project, service, request(), response()));
        }
    }
}

[Buggy Hunk]
user.name, ownerName, projectName));

[Patch]
user.loginId, ownerName, projectName));

[Demonstration 3]

[Buggy Method]
public JsonResult configureReader(Request req, Response resp) {
    formatResponse(resp);
    String agentIP = req.queryParams("agentIP");
    Agent agent = agents.get(agentIP);
    if (agent == null) {
        return new JsonResult(1003);
    }
    return new JsonResult(0);
}

[Buggy Hunk]
String agentIP = req.queryParams("agentIP");

[Patch]
String agentIP = req.params("agentIP");