Program: CWE-352
Project: CVE-2013-7251
Buggy source:
<html lang="en" xmlns:wicket="http://wicket.apache.org/dtds.data/wicket-xhtml1.4-strict.dtd">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>

<body>
  <wicket:panel>
    <div class="navbar-inner">
      <div class="container">
        <a class="btn btn-navbar" data-toggle="collapse" data-target=".navbar-responsive-collapse"> <span class="icon-bar"></span> <span
          class="icon-bar"></span> <span class="icon-bar"></span>
        </a>
        <div class="nav-collapse collapse navbar-responsive-collapse">
          <ul class="nav pf_sitemap">
            <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown"><i class="icon-sitemap"></i><span
                class="badge badge-important" wicket:id="totalMenuCounter">[8]</span><b class="caret"></b></a>
              <ul class="dropdown-menu">
                <li class="dropdown-submenu" wicket:id="completeMenuCategoryRepeater"><a href="#"><span wicket:id="menuCategoryLabel">[General]</span><span
                    class="badge badge-important" wicket:id="suffix">[5]</span></a>
                  <ul class="dropdown-menu">
                    <li wicket:id="completeSubMenuRepeater"><a wicket:id="link"><span wicket:id="label">[Addresses]</span><span
                        class="badge badge-important" wicket:id="suffix">[5]</span></a></li>
                  </ul></li>
              </ul></li>
          </ul>
          <wicket:container wicket:id="menuconfig"></wicket:container>
          <div id="pf_sortablecontainer">
            <ul class="nav" role="menu">
              <li id="pf_newentry" class="pf_disable"><input type="text" class="text"><a class="pf_safenewentry"><i
                  class="icon-plus-sign"></i></a></li>
              <li wicket:id="goMobile"><a href="#" wicket:id="link"><wicket:message key="menu.mobileMenu" /></a></li>
              <li wicket:id="menuRepeater"><a href="#" wicket:id="link"><span wicket:id="label">[Generic]</span><span
                  class="badge badge-important" wicket:id="suffix">[5]</span> <b class="caret" wicket:id="caret"></b></a>
                <ul class="dropdown-menu" wicket:id="subMenu">
                  <li wicket:id="subMenuRepeater"><a wicket:id="link"><span wicket:id="label">[Addresses]</span><span
                      class="badge badge-important" wicket:id="suffix">[5]</span></a></li>
                </ul></li>
            </ul>
          </div>
          <form class="navbar-search pull-left" wicket:id="searchForm" autocomplete="off">
            <input type="text" class="search-query span2" placeholder="Search" wicket:id="searchField">
          </form>
          <ul class="nav pull-right">
            <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown"><span wicket:id="user">[Kai Reinhard]</span><b
                class="caret"></b></a>
              <ul class="dropdown-menu">
                <li><a href="wa/layoutSettings" wicket:id="layoutSettingsMenuLink"><wicket:message key="menu.gear.layoutsettings" /></a></li>
                <li><a href="wa/feedback" wicket:id="feedbackLink"><wicket:message key="menu.gear.feedback" /></a></li>
                <li class="divider"></li>
                <li><a href="#" wicket:id="showBookmarkLink"><wicket:message key="menu.gear.showBookmark" /></a></li>
                <li><a wicket:id="documentationLink" href="/myAccount"><wicket:message key="menu.documentation" /></a></li>
                <li><a wicket:id="myAccountLink" href="/myAccount"><wicket:message key="menu.myAccount" /></a></li>
                <li><a wicket:id="logoutLink" href="/login?logout=true"><wicket:message key="menu.logout" /></a></li>
              </ul></li>
          </ul>
        </div>
      </div>
    </div>
  </wicket:panel>

</body>
</html>


Fixed version (ground truth):
<html lang="en" xmlns:wicket="http://wicket.apache.org/dtds.data/wicket-xhtml1.4-strict.dtd">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>

<body>
  <wicket:panel>
    <div class="navbar-inner">
      <div class="container">
        <a class="btn btn-navbar" data-toggle="collapse" data-target=".navbar-responsive-collapse"> <span class="icon-bar"></span> <span
          class="icon-bar"></span> <span class="icon-bar"></span>
        </a>
        <div class="nav-collapse collapse navbar-responsive-collapse">
          <ul class="nav pf_sitemap">
            <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown"><i class="icon-sitemap"></i><span
                class="badge badge-important" wicket:id="totalMenuCounter">[8]</span><b class="caret"></b></a>
              <ul class="dropdown-menu">
                <li class="dropdown-submenu" wicket:id="completeMenuCategoryRepeater"><a href="#"><span wicket:id="menuCategoryLabel">[General]</span><span
                    class="badge badge-important" wicket:id="suffix">[5]</span></a>
                  <ul class="dropdown-menu">
                    <li wicket:id="completeSubMenuRepeater"><a wicket:id="link"><span wicket:id="label">[Addresses]</span><span
                        class="badge badge-important" wicket:id="suffix">[5]</span></a></li>
                  </ul></li>
              </ul></li>
          </ul>
          <wicket:container wicket:id="menuconfig"></wicket:container>
          <div id="pf_sortablecontainer">
            <ul class="nav" role="menu">
              <li id="pf_newentry" class="pf_disable"><input type="text" class="text"><a class="pf_safenewentry"><i
                  class="icon-plus-sign"></i></a></li>
              <li wicket:id="goMobile"><a href="#" wicket:id="link"><wicket:message key="menu.mobileMenu" /></a></li>
              <li wicket:id="menuRepeater"><a href="#" wicket:id="link"><span wicket:id="label">[Generic]</span><span
                  class="badge badge-important" wicket:id="suffix">[5]</span> <b class="caret" wicket:id="caret"></b></a>
                <ul class="dropdown-menu" wicket:id="subMenu">
                  <li wicket:id="subMenuRepeater"><a wicket:id="link"><span wicket:id="label">[Addresses]</span><span
                      class="badge badge-important" wicket:id="suffix">[5]</span></a></li>
                </ul></li>
            </ul>
          </div>
          <form class="navbar-search pull-left" wicket:id="searchForm" autocomplete="off">
            <input type="text" class="search-query span2" placeholder="Search" wicket:id="searchField">
            <input type="hidden" wicket:id="csrfToken" />
          </form>
          <ul class="nav pull-right">
            <li class="dropdown"><a href="#" class="dropdown-toggle" data-toggle="dropdown"><span wicket:id="user">[Kai Reinhard]</span><b
                class="caret"></b></a>
              <ul class="dropdown-menu">
                <li><a href="wa/layoutSettings" wicket:id="layoutSettingsMenuLink"><wicket:message key="menu.gear.layoutsettings" /></a></li>
                <li><a href="wa/feedback" wicket:id="feedbackLink"><wicket:message key="menu.gear.feedback" /></a></li>
                <li class="divider"></li>
                <li><a href="#" wicket:id="showBookmarkLink"><wicket:message key="menu.gear.showBookmark" /></a></li>
                <li><a wicket:id="documentationLink" href="/myAccount"><wicket:message key="menu.documentation" /></a></li>
                <li><a wicket:id="myAccountLink" href="/myAccount"><wicket:message key="menu.myAccount" /></a></li>
                <li><a wicket:id="logoutLink" href="/login?logout=true"><wicket:message key="menu.logout" /></a></li>
              </ul></li>
          </ul>
        </div>
      </div>
    </div>
  </wicket:panel>

</body>
</html>