Program: CWE-79
Project: CVE-2012-4267
Buggy source:

<%import>
    com.pugh.sockso.Constants;
    com.pugh.sockso.Utils;
    com.pugh.sockso.Properties;
    com.pugh.sockso.music.Track;
    com.pugh.sockso.music.Playlist;
    com.pugh.sockso.resources.Locale;
    com.pugh.sockso.web.User;
    java.util.Vector;
</%import>

<%implements>
    com.pugh.sockso.web.PageTemplate;
</%implements>

<%args>
    Properties properties = null;
    Vector<Track> tracks = null;
    Playlist playlist = null;
    User user = null;
    Locale locale = null;
    Vector<User> recentUsers = null;
</%args>

<& ../IHeader; properties=properties; title="Playlist: " + playlist.getName(); user=user; locale=locale; &>

<h2>
    <div class="links">
        <% Utils.u2e(playlist.getName()) #n %>
        <div class="links">
            <& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); shareLink=true; playRandomLink=true; locale=locale; properties=properties; &>
        </div>
    </div>
</h2>

<br />

<ul class="musiclist">
<%if tracks.size() > 0 %>
    <%for Track track : tracks %>
        <li class="track">
            <& IMusicLinks; type="tr"; id=track.getId(); name=track.getName(); locale=locale; properties=properties; &>
            <a href="<% properties.getUrl("/browse/artist/"+track.getArtist().getId()) #n %>"><% Utils.u2e(track.getArtist().getName()) #n %></a> -
            <a href="<% properties.getUrl("/browse/album/"+track.getAlbum().getId()) #n %>"><% Utils.u2e(track.getAlbum().getName()) #n %></a> -
            <span class="link"><% Utils.u2e(track.getName()) #n %></span>
        </li>
    </%for>
<%else>
    <li class="empty"><% locale.getString("www.text.noResults") %></li>
</%if>
</ul>

<& ../IFooter; user=user; locale=locale; properties=properties; recentUsers=recentUsers; &>


Fixed version (ground truth):

<%import>
    com.pugh.sockso.Constants;
    com.pugh.sockso.Utils;
    com.pugh.sockso.Properties;
    com.pugh.sockso.music.Track;
    com.pugh.sockso.music.Playlist;
    com.pugh.sockso.resources.Locale;
    com.pugh.sockso.web.User;
    java.util.Vector;
</%import>

<%implements>
    com.pugh.sockso.web.PageTemplate;
</%implements>

<%args>
    Properties properties = null;
    Vector<Track> tracks = null;
    Playlist playlist = null;
    User user = null;
    Locale locale = null;
    Vector<User> recentUsers = null;
</%args>

<& ../IHeader; properties=properties; title="Playlist: " + Utils.XMLEncode(playlist.getName()); user=user; locale=locale; &>

<h2>
    <div class="links">
        <% Utils.XMLEncode(playlist.getName()) #n %>
        <div class="links">
            <& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); shareLink=true; playRandomLink=true; locale=locale; properties=properties; &>
        </div>
    </div>
</h2>

<br />

<ul class="musiclist">
<%if tracks.size() > 0 %>
    <%for Track track : tracks %>
        <li class="track">
            <& IMusicLinks; type="tr"; id=track.getId(); name=track.getName(); locale=locale; properties=properties; &>
            <a href="<% properties.getUrl("/browse/artist/"+track.getArtist().getId()) #n %>"><% Utils.u2e(track.getArtist().getName()) #n %></a> -
            <a href="<% properties.getUrl("/browse/album/"+track.getAlbum().getId()) #n %>"><% Utils.u2e(track.getAlbum().getName()) #n %></a> -
            <span class="link"><% Utils.u2e(track.getName()) #n %></span>
        </li>
    </%for>
<%else>
    <li class="empty"><% locale.getString("www.text.noResults") %></li>
</%if>
</ul>

<& ../IFooter; user=user; locale=locale; properties=properties; recentUsers=recentUsers; &>