[Demonstration 1]

[Buggy Method]
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    response.setContentType("text/html");
    JSONObject json = new JSONObject();
    HttpSession session = request.getSession();
    String login = (String) session.getAttribute("login");
    if (login != null) {
        //int score = ((Long) session.getAttribute("score")).intValue();
        String score = (String) session.getAttribute("score");
        try {
            json.put("response", "true");
            json.put("login", login);
            json.put("score", score);
        } catch (JSONException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    } else {
        try {
            json.put("response", "false");
        } catch (JSONException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }
    PrintWriter out = response.getWriter();
    out.print(json);
    out.flush();
}

[Buggy Hunk]
String score = (String) session.getAttribute("score");

[Patch]
long score = (long) session.getAttribute("score");

[Demonstration 2]

[Buggy Method]
@CrossOrigin
@RequestMapping(path = "/login", method = RequestMethod.POST)
public String login(Model model, HttpSession session, String username, String password) throws Exception {
    User user = users.findByUsername(username);
    if (user != null && PasswordStorage.verifyPassword(password, user.getPassword())) {
        session.setAttribute("user", user.getId());
    } else {
        session.setAttribute("loginError", true);
    }
    return "redirect:/";
}

[Buggy Hunk]
session.setAttribute("loginError", true);

[Patch]
session.setAttribute("error", "You entered an invalid password.");

[Demonstration 3]

[Buggy Method]
public static Result service(String ownerName, String projectName, String service, boolean isAdvertise) throws IOException, UnsupportedOperationException, ServletException {
    if (!isSupportedService(service)) {
        return forbidden(String.format("Unsupported service: '%s'", service));
    }
    Project project = Project.findByOwnerAndProjectName(ownerName, projectName);
    if (project == null) {
        return notFound();
    }
    models.User user = UserApp.currentUser();
    if (!isAllowed(project, service)) {
        if (user.isAnonymous()) {
            return BasicAuthAction.unauthorized(response());
        } else {
            // If you want the Git client showing your custom message to
            // the user, the Content-Type should be exact "text/plain"
            // without any parameter. For more details, see the code at
            // https://github.com/git/git/commit/426e70d4a11ce3b4f70636d57c6a0ab16ae08a00#diff-eea0ad565ec5903a11b6023755d491cfR154
            response().setHeader("Content-Type", "text/plain");
            return forbidden(String.format("'%s' has no permission to '%s/%s'.", user.name, ownerName, projectName));
        }
    }
    if (isAdvertise) {
        return ok(RepositoryService.gitAdvertise(project, service, response()));
    } else {
        if (request().body().isMaxSizeExceeded()) {
            return status(REQUEST_ENTITY_TOO_LARGE);
        } else {
            user.visits(project);
            return ok(RepositoryService.gitRpc(project, service, request(), response()));
        }
    }
}

[Buggy Hunk]
user.name, ownerName, projectName));

[Patch]
user.loginId, ownerName, projectName));