Program: CWE-79
Project: CVE-2017-15571
Buggy source:
<% query_options = nil unless defined?(query_options) %>
<% query_options ||= {} %>

<%= form_tag({}, :data => {:cm_url => issues_context_menu_path}) do -%>
<%= hidden_field_tag 'back_url', url_for(:params => request.query_parameters), :id => nil %>
<div class="autoscroll">
<table class="list issues odd-even <%= query.css_classes %>">
  <thead>
    <tr>
      <th class="checkbox hide-when-print">
        <%= check_box_tag 'check_all', '', false, :class => 'toggle-selection',
              :title => "#{l(:button_check_all)}/#{l(:button_uncheck_all)}" %>
      </th>
      <% query.inline_columns.each do |column| %>
        <%= column_header(query, column, query_options) %>
      <% end %>
    </tr>
  </thead>
  <tbody>
  <% grouped_issue_list(issues, query) do |issue, level, group_name, group_count, group_totals| -%>
  <% if group_name %>
    <% reset_cycle %>
    <tr class="group open">
      <td colspan="<%= query.inline_columns.size + 1 %>">
        <span class="expander" onclick="toggleRowGroup(this);">&nbsp;</span>
        <span class="name"><%= group_name %></span> <span class="count"><%= group_count %></span> <span class="totals"><%= group_totals %></span>
        <%= link_to_function("#{l(:button_collapse_all)}/#{l(:button_expand_all)}",
                             "toggleAllRowGroups(this)", :class => 'toggle-all') %>
      </td>
    </tr>
  <% end %>
  <tr id="issue-<%= issue.id %>" class="hascontextmenu <%= cycle('odd', 'even') %> <%= issue.css_classes %> <%= level > 0 ? "idnt idnt-#{level}" : nil %>">
    <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", issue.id, false, :id => nil) %></td>
    <%= raw query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, issue)}</td>"}.join %>
  </tr>
  <% query.block_columns.each do |column|
       if (text = column_content(column, issue)) && text.present? -%>
  <tr class="<%= current_cycle %>">
    <td colspan="<%= query.inline_columns.size + 1 %>" class="<%= column.css_classes %>">
      <% if query.block_columns.count > 1 %>
        <span><%= column.caption %></span>
      <% end %>
      <%= text %>
    </td>
  </tr>
  <% end -%>
  <% end -%>
  <% end -%>
  </tbody>
</table>
</div>
<% end -%>


Fixed version (ground truth):
<% query_options = nil unless defined?(query_options) %>
<% query_options ||= {} %>

<%= form_tag({}, :data => {:cm_url => issues_context_menu_path}) do -%>
<%= hidden_field_tag 'back_url', url_for(:params => request.query_parameters), :id => nil %>
<div class="autoscroll">
<table class="list issues odd-even <%= query.css_classes %>">
  <thead>
    <tr>
      <th class="checkbox hide-when-print">
        <%= check_box_tag 'check_all', '', false, :class => 'toggle-selection',
              :title => "#{l(:button_check_all)}/#{l(:button_uncheck_all)}" %>
      </th>
      <% query.inline_columns.each do |column| %>
        <%= column_header(query, column, query_options) %>
      <% end %>
    </tr>
  </thead>
  <tbody>
  <% grouped_issue_list(issues, query) do |issue, level, group_name, group_count, group_totals| -%>
  <% if group_name %>
    <% reset_cycle %>
    <tr class="group open">
      <td colspan="<%= query.inline_columns.size + 1 %>">
        <span class="expander" onclick="toggleRowGroup(this);">&nbsp;</span>
        <span class="name"><%= group_name %></span> <span class="count"><%= group_count %></span> <span class="totals"><%= group_totals %></span>
        <%= link_to_function("#{l(:button_collapse_all)}/#{l(:button_expand_all)}",
                             "toggleAllRowGroups(this)", :class => 'toggle-all') %>
      </td>
    </tr>
  <% end %>
  <tr id="issue-<%= issue.id %>" class="hascontextmenu <%= cycle('odd', 'even') %> <%= issue.css_classes %> <%= level > 0 ? "idnt idnt-#{level}" : nil %>">
    <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", issue.id, false, :id => nil) %></td>
    <% query.inline_columns.each do |column| %>
    <%= content_tag('td', column_content(column, issue), :class => column.css_classes) %>
    <% end %>
  </tr>
  <% query.block_columns.each do |column|
       if (text = column_content(column, issue)) && text.present? -%>
  <tr class="<%= current_cycle %>">
    <td colspan="<%= query.inline_columns.size + 1 %>" class="<%= column.css_classes %>">
      <% if query.block_columns.count > 1 %>
        <span><%= column.caption %></span>
      <% end %>
      <%= text %>
    </td>
  </tr>
  <% end -%>
  <% end -%>
  <% end -%>
  </tbody>
</table>
</div>
<% end -%>