Program: CWE-79
Project: CVE-2021-31712
Buggy source:
{
  "name": "react-draft-wysiwyg",
  "version": "1.14.5",
  "description": "A wysiwyg on top of DraftJS.",
  "main": "dist/react-draft-wysiwyg.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/jpuri/react-draft-wysiwyg.git"
  },
  "author": "Jyoti Puri",
  "devDependencies": {
    "@babel/core": "^7.7.4",
    "@babel/preset-env": "^7.7.4",
    "@babel/preset-react": "^7.7.4",
    "@babel/register": "^7.7.4",
    "@storybook/react": "^5.2.8",
    "autoprefixer": "^9.7.3",
    "babel-eslint": "^10.0.3",
    "babel-loader": "^8.0.6",
    "babel-plugin-transform-flow-strip-types": "^6.22.0",
    "chai": "^4.2.0",
    "cross-env": "^6.0.3",
    "css-loader": "^3.2.1",
    "draft-js": "^0.11.2",
    "draftjs-to-html": "^0.9.0",
    "draftjs-to-markdown": "^0.6.0",
    "embed-video": "^2.0.4",
    "enzyme": "^3.10.0",
    "enzyme-adapter-react-16": "^1.15.1",
    "eslint": "^6.7.2",
    "eslint-config-airbnb": "^18.0.1",
    "eslint-plugin-import": "^2.18.2",
    "eslint-plugin-jsx-a11y": "^6.2.3",
    "eslint-plugin-mocha": "^6.2.2",
    "eslint-plugin-react": "^7.17.0",
    "file-loader": "^5.0.2",
    "flow-bin": "^0.113.0",
    "immutable": "^4.0.0-rc.12",
    "jsdom": "^15.2.1",
    "mini-css-extract-plugin": "^0.8.0",
    "mocha": "^6.2.2",
    "postcss-loader": "^3.0.0",
    "precss": "^4.0.0",
    "react": "^16.12.0",
    "react-addons-test-utils": "^15.6.2",
    "react-dom": "^16.12.0",
    "react-test-renderer": "^16.12.0",
    "rimraf": "^3.0.0",
    "sinon": "^7.5.0",
    "style-loader": "^1.0.1",
    "uglifyjs-webpack-plugin": "^2.2.0",
    "url-loader": "^3.0.0",
    "webpack": "^4.41.2",
    "webpack-bundle-analyzer": "^3.6.0",
    "webpack-cli": "^3.3.10"
  },
  "dependencies": {
    "classnames": "^2.2.6",
    "draftjs-utils": "^0.10.2",
    "html-to-draftjs": "^1.5.0",
    "linkify-it": "^2.2.0",
    "prop-types": "^15.7.2"
  },
  "peerDependencies": {
    "draft-js": "^0.10.x || ^0.11.x",
    "immutable": "3.x.x || 4.x.x",
    "react": "0.13.x || 0.14.x || ^15.0.0-0 || 15.x.x || ^16.0.0-0 || ^16.x.x",
    "react-dom": "0.13.x || 0.14.x || ^15.0.0-0 || 15.x.x || ^16.0.0-0 || ^16.x.x"
  },
  "scripts": {
    "clean": "rimraf dist",
    "build:webpack": "cross-env NODE_ENV=production webpack  --mode production --config config/webpack.config.js",
    "build": "npm run clean && npm run build:webpack",
    "test": "cross-env BABEL_ENV=test mocha --require config/test-compiler.js config/test-setup.js src/**/*Test.js",
    "lint": "eslint src",
    "lintdocs": "eslint docs/src",
    "flow": "flow; test $? -eq 0 -o $? -eq 2",
    "check": "npm run lint && npm run flow",
    "storybook": "start-storybook -p 6006",
    "build-storybook": "build-storybook"
  },
  "license": "MIT"
}


Fixed version (ground truth):
{
  "name": "react-draft-wysiwyg",
  "version": "1.14.6",
  "description": "A wysiwyg on top of DraftJS.",
  "main": "dist/react-draft-wysiwyg.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/jpuri/react-draft-wysiwyg.git"
  },
  "author": "Jyoti Puri",
  "devDependencies": {
    "@babel/core": "^7.7.4",
    "@babel/preset-env": "^7.7.4",
    "@babel/preset-react": "^7.7.4",
    "@babel/register": "^7.7.4",
    "@storybook/react": "^5.2.8",
    "autoprefixer": "^9.7.3",
    "babel-eslint": "^10.0.3",
    "babel-loader": "^8.0.6",
    "babel-plugin-transform-flow-strip-types": "^6.22.0",
    "chai": "^4.2.0",
    "cross-env": "^6.0.3",
    "css-loader": "^3.2.1",
    "draft-js": "^0.11.2",
    "draftjs-to-html": "^0.9.0",
    "draftjs-to-markdown": "^0.6.0",
    "embed-video": "^2.0.4",
    "enzyme": "^3.10.0",
    "enzyme-adapter-react-16": "^1.15.1",
    "eslint": "^6.7.2",
    "eslint-config-airbnb": "^18.0.1",
    "eslint-plugin-import": "^2.18.2",
    "eslint-plugin-jsx-a11y": "^6.2.3",
    "eslint-plugin-mocha": "^6.2.2",
    "eslint-plugin-react": "^7.17.0",
    "file-loader": "^5.0.2",
    "flow-bin": "^0.113.0",
    "immutable": "^4.0.0-rc.12",
    "jsdom": "^15.2.1",
    "mini-css-extract-plugin": "^0.8.0",
    "mocha": "^6.2.2",
    "postcss-loader": "^3.0.0",
    "precss": "^4.0.0",
    "react": "^16.12.0",
    "react-addons-test-utils": "^15.6.2",
    "react-dom": "^16.12.0",
    "react-test-renderer": "^16.12.0",
    "rimraf": "^3.0.0",
    "sinon": "^7.5.0",
    "style-loader": "^1.0.1",
    "uglifyjs-webpack-plugin": "^2.2.0",
    "url-loader": "^3.0.0",
    "webpack": "^4.41.2",
    "webpack-bundle-analyzer": "^3.6.0",
    "webpack-cli": "^3.3.10"
  },
  "dependencies": {
    "classnames": "^2.2.6",
    "draftjs-utils": "^0.10.2",
    "html-to-draftjs": "^1.5.0",
    "linkify-it": "^2.2.0",
    "prop-types": "^15.7.2"
  },
  "peerDependencies": {
    "draft-js": "^0.10.x || ^0.11.x",
    "immutable": "3.x.x || 4.x.x",
    "react": "0.13.x || 0.14.x || ^15.0.0-0 || 15.x.x || ^16.0.0-0 || ^16.x.x",
    "react-dom": "0.13.x || 0.14.x || ^15.0.0-0 || 15.x.x || ^16.0.0-0 || ^16.x.x"
  },
  "scripts": {
    "clean": "rimraf dist",
    "build:webpack": "cross-env NODE_ENV=production webpack  --mode production --config config/webpack.config.js",
    "build": "npm run clean && npm run build:webpack",
    "test": "cross-env BABEL_ENV=test mocha --require config/test-compiler.js config/test-setup.js src/**/*Test.js",
    "lint": "eslint src",
    "lintdocs": "eslint docs/src",
    "flow": "flow; test $? -eq 0 -o $? -eq 2",
    "check": "npm run lint && npm run flow",
    "storybook": "start-storybook -p 6006",
    "build-storybook": "build-storybook"
  },
  "license": "MIT"
}