Program: CWE-79
Project: CVE-2019-14669
Buggy source:
{% extends "./layout/default" %}

{% block breadcrumbs %}
    {{ Breadcrumbs.render(Route.getCurrentRoute.getName, accountIds, start, end) }}
{% endblock %}

{% block content %}

<div class="row no-print">
    <div class="col-lg-12 col-md-12 col-sm-12 col-xs-12">
        <div class="box" id="optionsBox">
            <div class="box-header with-border">
                <h3 class="box-title">{{ 'options'|_ }}</h3>
            </div>
            <div class="box-body">
                <ul class="list-inline">
                    {% for hide in hideable %}
                        <li><input
                                    {% if hide in defaultShow %}checked{% endif %}
                                    type="checkbox" class="audit-option-checkbox" name="option[]" value="{{ hide }}" id="option_{{ hide }}"/> <label
                                    for="option_{{ hide }}" style="font-weight:normal;">{{ trans('list.'~hide) }}</label></li>
                    {% endfor %}

                </ul>
            </div>
        </div>
    </div>
</div>


{% for account in accounts %}
<div class="row">
    <div class="col-lg-12 col-md-12 col-sm-12">
        <div class="box">
            <div class="box-header with-border">
                <h3 class="box-title">{{ account.name }}</h3>
            </div>
            {% set url = route('accounts.show',account.id) %}
            {% if not auditData[account.id].exists %}
            <div class="box-body">

                <em>
                    {{ trans('firefly.no_audit_activity',
                        {
                            account_name: account.name,
                            url: url,
                            start: start.formatLocalized(monthAndDayFormat),
                            end: end.formatLocalized(monthAndDayFormat),
                        })|raw }}
                </em>
            </div>
            {% else %}
            <div class="box-body table-responsive no-padding">
                <p style="padding:10px;">

                    {{ trans('firefly.audit_end_balance',
                        {
                            account_name: account.name,
                            url: url,
                            end: auditData[account.id].end,
                            balance: formatAmountByAccount(account,auditData[account.id].endBalance)
                        })|raw }}
                </p>
                {% include 'reports.partials.journals-audit'  with {'journals': auditData[account.id].journals,'account':account} %}
                <p style="padding:10px;">
                    {{ trans('firefly.audit_end_balance',
                        {
                            account_name: account.name,
                            url: url,
                            end: auditData[account.id].dayBefore,
                            balance: formatAmountByAccount(account, auditData[account.id].dayBeforeBalance)
                        })|raw }}
                </p>
            </div>
            {% endif %}
        </div>
    </div>
</div>
{% endfor %}

{% endblock %}
{% block styles %}
{% endblock %}
{% block scripts %}
    <script type="text/javascript">
        var hideable = {{ hideable|json_encode|raw }};
    </script>
    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
    <script type="text/javascript" src="v1/js/ff/reports/audit/all.js?v={{ FF_VERSION }}"></script>
{% endblock %}


Fixed version (ground truth):
{% extends "./layout/default" %}

{% block breadcrumbs %}
    {{ Breadcrumbs.render(Route.getCurrentRoute.getName, accountIds, start, end) }}
{% endblock %}

{% block content %}

<div class="row no-print">
    <div class="col-lg-12 col-md-12 col-sm-12 col-xs-12">
        <div class="box" id="optionsBox">
            <div class="box-header with-border">
                <h3 class="box-title">{{ 'options'|_ }}</h3>
            </div>
            <div class="box-body">
                <ul class="list-inline">
                    {% for hide in hideable %}
                        <li><input
                                    {% if hide in defaultShow %}checked{% endif %}
                                    type="checkbox" class="audit-option-checkbox" name="option[]" value="{{ hide }}" id="option_{{ hide }}"/> <label
                                    for="option_{{ hide }}" style="font-weight:normal;">{{ trans('list.'~hide) }}</label></li>
                    {% endfor %}

                </ul>
            </div>
        </div>
    </div>
</div>


{% for account in accounts %}
<div class="row">
    <div class="col-lg-12 col-md-12 col-sm-12">
        <div class="box">
            <div class="box-header with-border">
                <h3 class="box-title">{{ account.name }}</h3>
            </div>
            {% set url = route('accounts.show',account.id) %}
            {% if not auditData[account.id].exists %}
            <div class="box-body">

                <em>
                    {{ trans('firefly.no_audit_activity',
                        {
                            account_name: account.name|escape,
                            url: url,
                            start: start.formatLocalized(monthAndDayFormat),
                            end: end.formatLocalized(monthAndDayFormat),
                        })|raw }}
                </em>
            </div>
            {% else %}
            <div class="box-body table-responsive no-padding">
                <p style="padding:10px;">

                    {{ trans('firefly.audit_end_balance',
                        {
                            account_name: account.name|escape,
                            url: url,
                            end: auditData[account.id].end,
                            balance: formatAmountByAccount(account,auditData[account.id].endBalance)
                        })|raw }}
                </p>
                {% include 'reports.partials.journals-audit'  with {'journals': auditData[account.id].journals,'account':account} %}
                <p style="padding:10px;">
                    {{ trans('firefly.audit_end_balance',
                        {
                            account_name: account.name|escape,
                            url: url,
                            end: auditData[account.id].dayBefore,
                            balance: formatAmountByAccount(account, auditData[account.id].dayBeforeBalance)
                        })|raw }}
                </p>
            </div>
            {% endif %}
        </div>
    </div>
</div>
{% endfor %}

{% endblock %}
{% block styles %}
{% endblock %}
{% block scripts %}
    <script type="text/javascript">
        var hideable = {{ hideable|json_encode|raw }};
    </script>
    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
    <script type="text/javascript" src="v1/js/ff/reports/audit/all.js?v={{ FF_VERSION }}"></script>
{% endblock %}