[Demonstration 1]

[Buggy Method]
@ModelAttribute
User find(@PathVariable("id") Long id, @AuthenticationPrincipal MyReaderUser user) {
    if (id.compareTo(user.getId()) != 0) {
        //don't differentiate between not found and access denied
        throw new ResourceNotFoundException();
    }
    return userRepository.findOne(user.getId());
}

[Buggy Hunk]
User find(@PathVariable("id") Long id, @AuthenticationPrincipal MyReaderUser user) {

[Patch]
public User find(@PathVariable("id") Long id, @AuthenticationPrincipal MyReaderUser user) {

[Demonstration 2]

[Buggy Method]
@Override
public List<HDAccount.HDAccountAddress> getSigningAddressesForInputs(List<In> inList) {
    SQLiteDatabase db = this.mDb.getReadableDatabase();
    List<HDAccount.HDAccountAddress> hdAccountAddressList = new ArrayList<HDAccount.HDAccountAddress>();
    Cursor c;
    for (In in : inList) {
        String sql = "select a.address,a.path_type,a.address_index,a.is_synced" + " from hd_account_addresses a ,outs b" + " where a.address=b.out_address" + " and b.tx_hash=? and b.out_sn=?  ";
        OutPoint outPoint = in.getOutpoint();
        c = db.rawQuery(sql, new String[] { Base58.encode(outPoint.getTxHash()), Integer.toString(in.getInSn()) });
        if (c.moveToNext()) {
            hdAccountAddressList.add(formatAddress(c));
        }
        c.close();
    }
    return hdAccountAddressList;
}

[Buggy Hunk]
c = db.rawQuery(sql, new String[]{Base58.encode(outPoint.getTxHash()), Integer.toString(in.getInSn())});

[Patch]
c = db.rawQuery(sql, new String[]{Base58.encode(in.getPrevTxHash()), Integer.toString(outPoint.getOutSn())});

[Demonstration 3]

[Buggy Method]
@SuppressWarnings("rawtypes")
@RequestMapping(value = "/{collection}/{id}", method = RequestMethod.DELETE)
public ResponseEntity<Map> delete(@PathVariable String collection, @PathVariable String id) {
    try {
        Map data = metaService.get(collection, id);
        if (data == null) {
            return new ResponseEntity<Map>(HttpStatus.NOT_FOUND);
        }
        metaService.delete(collection, id);
        return new ResponseEntity<Map>(data, HttpStatus.OK);
    } catch (Exception ex) {
        if (ex instanceof CollectionNotFoundException) {
            return new ResponseEntity<Map>(HttpStatus.NOT_FOUND);
        } else {
            ex.printStackTrace();
            return new ResponseEntity<Map>(HttpStatus.INTERNAL_SERVER_ERROR);
        }
    }
}

[Buggy Hunk]
ex.printStackTrace();

[Patch]
logger.error("DELETE: /metapi/"+collection+"/"+id, ex);