Language: PHP
Label: vulnerable
CWE: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.

Code:
    public function testRender()
    {
        $kernel = self::bootKernel();
        /** @var Environment $twig */
        $twig = self::getContainer()->get('twig');
        $stack = self::getContainer()->get('request_stack');
        $request = new Request();
        $request->setLocale('en');
        $stack->push($request);

        /** @var FilesystemLoader $loader */
        $loader = $twig->getLoader();
        $loader->addPath($this->getInvoiceTemplatePath(), 'invoice');

        $sut = new TwigRenderer($twig);

        $model = $this->getInvoiceModel();
        $model->getTemplate()->setLanguage('de');

        $document = $this->getInvoiceDocument('timesheet.html.twig');
        $response = $sut->render($document, $model);

        $content = $response->getContent();

        $filename = $model->getInvoiceNumber() . '-customer_with_special_name';
        $this->assertStringContainsString('<title>' . $filename . '</title>', $content);
        $this->assertStringContainsString('<span contenteditable="true">a very *long* test invoice / template title with [ßpecial] chäracter</span>', $content);
        // 3 timesheets have a description and therefor do not render the activity
        // 2 timesheets have no description and the correct activity assigned
        $this->assertEquals(2, substr_count($content, 'activity description'));
        $this->assertStringContainsString(nl2br("foo\n" .
    "foo\r\n" .
    'foo' . PHP_EOL .
    "bar\n" .
    "bar\r\n" .
    'Hello'), $content);
    }