Program: CWE-352
Project: CVE-2021-39133
Buggy source:
{% extends './v1/layout/default' %}

{% block breadcrumbs %}
    {{ Breadcrumbs.render(Route.getCurrentRoute.getName, bill) }}
{% endblock %}

{% block content %}

    <div class="row">
        <div class="col-lg-6 col-sm-12 col-md-12">
            <div class="box" id="billInfo">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ object.data.name }}</h3>

                    <div class="box-tools pull-right">
                        <div class="btn-group">
                            <button class="btn btn-box-tool dropdown-toggle" data-toggle="dropdown"><span class="fa fa-ellipsis-v"></span></button>
                            <ul class="dropdown-menu" role="menu">
                                <li><a href="{{ route('bills.edit', object.data.id) }}"><span class="fa fa-fw fa-pencil"></span> {{ 'edit'|_ }}</a></li>
                                <li><a href="{{ route('bills.delete', object.data.id) }}"><span class="fa fa-fw fa-trash-o"></span> {{ 'delete'|_ }}</a></li>
                            </ul>
                        </div>
                    </div>

                </div>
                <div class="box-body">
                    <table class="table table-striped">
                        <tr>
                            <td colspan="2">
                                {{ trans('firefly.match_between_amounts', {low: formatAmountByCurrency(object.data.currency,object.data.amount_min), high: formatAmountByCurrency(object.data.currency,object.data.amount_max) })|raw }}
                                {{ 'repeats'|_ }}
                                {{ trans('firefly.repeat_freq_' ~object.data.repeat_freq) }}.
                            </td>
                        </tr>

                        <tr>
                            <td style="width:50%;">{{ 'bill_is_active'|_ }}</td>
                            <td>
                                {% if object.data.active %}
                                    <span class="fa fa-check fa-fw" title="{{ 'active'|_ }}"></span> {{ 'yes'|_ }}
                                {% else %}
                                    <span class="fa fa-times fa-fw" title="{{ 'inactive'|_ }}"></span> {{ 'no'|_ }}
                                {% endif %}
                            </td>
                        </tr>
                        <tr>
                            <td>{{ 'next_expected_match'|_ }}</td>
                            <td>
                                {% if object.data.next_expected_match|length > 0 %}
                                    {{ formatDate(object.data.next_expected_match, monthAndDayFormat) }}
                                {% else %}
                                    {{ 'unknown'|_ }}
                                {% endif %}
                            </td>
                        </tr>
                        <tr>
                            <td>{{ trans('firefly.average_bill_amount_year', {year: year}) }}</td>
                            <td>
                                {% for avg in yearAverage %}
                                    {{ formatAmountBySymbol(avg.avg, avg.currency_symbol, avg.currency_decimal_places, true) }}<br>
                                {% endfor %}
                            </td>
                        </tr>
                        <tr>
                            <td>{{ 'average_bill_amount_overall'|_ }}</td>
                            <td>
                                {% for avg in overallAverage %}
                                    {{ formatAmountBySymbol(avg.avg, avg.currency_symbol, avg.currency_decimal_places, true) }}<br>
                                {% endfor %}
                            </td>
                        </tr>
                    </table>
                </div>
                <div class="box-footer">
                    <div class="btn-group">
                        <a class="btn btn-default" href="{{ route('bills.edit', [object.data.id]) }}">{{ 'edit'|_ }}</a>
                        <a class="btn btn-danger" href="{{ route('bills.delete', [object.data.id]) }}">{{ 'delete'|_ }}</a>
                    </div>
                </div>
            </div>
        </div>
        <div class="col-lg-6 col-sm-12 col-md-12">
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'bill_related_rules'|_ }}</h3>
                </div>
                <div class="box-body">
                    {% if rules.count() > 0 %}
                        <ul>
                            {% for rule in rules %}
                                <li><a href="{{ route('rules.edit', [rule.id]) }}">{{ rule.title }}</a>
                                    {% if not rule.active %}({{ 'list_inactive_rule'|_|lower }}){% endif %}
                                </li>
                            {% endfor %}
                        </ul>
                    {% endif %}
                </div>
                <div class="box-footer">
                    <p><a id="billButtons" href="{{ route('bills.rescan',object.data.id) }}" class="btn btn-default">{{ 'rescan_old'|_ }}</a></p>
                    <p><small class="text-muted">
                            {{ 'running_again_loss'|_ }}
                        </small>

                    </p>
                </div>
            </div>
            {% if object.data.notes %}
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'notes'|_ }}</h3>
                </div>
                <div class="box-body">
                    {{ object.data.notes|default('')|markdown }}
                </div>
            </div>
            {% endif %}


            {% if attachments.count() > 0 %}
                <div class="box">
                    <div class="box-header with-border">
                        <h3 class="box-title">{{ 'attachments'|_ }}</h3>
                    </div>
                    <div class="box-body no-padding">
                        {% include 'v1.list.attachments' %}
                    </div>
                </div>
            {% endif %}
        </div>
    </div>

    <div class="row">
        <div class="col-lg-12 col-sm-12 col-md-12">
            <div class="box" id="billChart">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'chart'|_ }}</h3>
                </div>
                <div class="box-body">
                    <canvas id="bill-overview" style="width:100%;height:400px;" height="400" width="100%"></canvas>
                </div>
            </div>
        </div>
    </div>

    <div class="row">
        <div class="col-lg-12 col-sm-12 col-md-12">
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'connected_journals'|_ }}</h3>
                </div>
                <div class="box-body">
                    {% include 'v1.list.groups' %}
                </div>
            </div>
        </div>
    </div>

{% endblock %}

{% block scripts %}
    <script type="text/javascript" nonce="{{ JS_NONCE }}">
        var billCurrencySymbol = "{{ object.data.currency.symbol }}";
        var billUri = '{{ route('chart.bill.single', [object.data.id]) }}';
    </script>
    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    <script type="text/javascript" src="v1/js/ff/bills/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    {# required for groups.twig #}
    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
{% endblock %}


Fixed version (ground truth):
{% extends './v1/layout/default' %}

{% block breadcrumbs %}
    {{ Breadcrumbs.render(Route.getCurrentRoute.getName, bill) }}
{% endblock %}

{% block content %}

    <div class="row">
        <div class="col-lg-6 col-sm-12 col-md-12">
            <div class="box" id="billInfo">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ object.data.name }}</h3>

                    <div class="box-tools pull-right">
                        <div class="btn-group">
                            <button class="btn btn-box-tool dropdown-toggle" data-toggle="dropdown"><span class="fa fa-ellipsis-v"></span></button>
                            <ul class="dropdown-menu" role="menu">
                                <li><a href="{{ route('bills.edit', object.data.id) }}"><span class="fa fa-fw fa-pencil"></span> {{ 'edit'|_ }}</a></li>
                                <li><a href="{{ route('bills.delete', object.data.id) }}"><span class="fa fa-fw fa-trash-o"></span> {{ 'delete'|_ }}</a></li>
                            </ul>
                        </div>
                    </div>

                </div>
                <div class="box-body">
                    <table class="table table-striped">
                        <tr>
                            <td colspan="2">
                                {{ trans('firefly.match_between_amounts', {low: formatAmountByCurrency(object.data.currency,object.data.amount_min), high: formatAmountByCurrency(object.data.currency,object.data.amount_max) })|raw }}
                                {{ 'repeats'|_ }}
                                {{ trans('firefly.repeat_freq_' ~object.data.repeat_freq) }}.
                            </td>
                        </tr>

                        <tr>
                            <td style="width:50%;">{{ 'bill_is_active'|_ }}</td>
                            <td>
                                {% if object.data.active %}
                                    <span class="fa fa-check fa-fw" title="{{ 'active'|_ }}"></span> {{ 'yes'|_ }}
                                {% else %}
                                    <span class="fa fa-times fa-fw" title="{{ 'inactive'|_ }}"></span> {{ 'no'|_ }}
                                {% endif %}
                            </td>
                        </tr>
                        <tr>
                            <td>{{ 'next_expected_match'|_ }}</td>
                            <td>
                                {% if object.data.next_expected_match|length > 0 %}
                                    {{ formatDate(object.data.next_expected_match, monthAndDayFormat) }}
                                {% else %}
                                    {{ 'unknown'|_ }}
                                {% endif %}
                            </td>
                        </tr>
                        <tr>
                            <td>{{ trans('firefly.average_bill_amount_year', {year: year}) }}</td>
                            <td>
                                {% for avg in yearAverage %}
                                    {{ formatAmountBySymbol(avg.avg, avg.currency_symbol, avg.currency_decimal_places, true) }}<br>
                                {% endfor %}
                            </td>
                        </tr>
                        <tr>
                            <td>{{ 'average_bill_amount_overall'|_ }}</td>
                            <td>
                                {% for avg in overallAverage %}
                                    {{ formatAmountBySymbol(avg.avg, avg.currency_symbol, avg.currency_decimal_places, true) }}<br>
                                {% endfor %}
                            </td>
                        </tr>
                    </table>
                </div>
                <div class="box-footer">
                    <div class="btn-group">
                        <a class="btn btn-default" href="{{ route('bills.edit', [object.data.id]) }}">{{ 'edit'|_ }}</a>
                        <a class="btn btn-danger" href="{{ route('bills.delete', [object.data.id]) }}">{{ 'delete'|_ }}</a>
                    </div>
                </div>
            </div>
        </div>
        <div class="col-lg-6 col-sm-12 col-md-12">
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'bill_related_rules'|_ }}</h3>
                </div>
                <div class="box-body">
                    {% if rules.count() > 0 %}
                        <ul>
                            {% for rule in rules %}
                                <li><a href="{{ route('rules.edit', [rule.id]) }}">{{ rule.title }}</a>
                                    {% if not rule.active %}({{ 'list_inactive_rule'|_|lower }}){% endif %}
                                </li>
                            {% endfor %}
                        </ul>
                    {% endif %}
                </div>
                <div class="box-footer">
                    <form action="{{ route('bills.rescan',object.data.id) }}" method="post">
                        <input type="hidden" name="_token" value="{{ csrf_token() }}"/>
                        <p>
                            <input type="submit" name="submit" value="{{ 'rescan_old'|_ }}" class="btn btn-default" />
                        </p>
                    </form>

                    <p><small class="text-muted">
                            {{ 'running_again_loss'|_ }}
                        </small>

                    </p>
                </div>
            </div>
            {% if object.data.notes %}
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'notes'|_ }}</h3>
                </div>
                <div class="box-body">
                    {{ object.data.notes|default('')|markdown }}
                </div>
            </div>
            {% endif %}


            {% if attachments.count() > 0 %}
                <div class="box">
                    <div class="box-header with-border">
                        <h3 class="box-title">{{ 'attachments'|_ }}</h3>
                    </div>
                    <div class="box-body no-padding">
                        {% include 'v1.list.attachments' %}
                    </div>
                </div>
            {% endif %}
        </div>
    </div>

    <div class="row">
        <div class="col-lg-12 col-sm-12 col-md-12">
            <div class="box" id="billChart">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'chart'|_ }}</h3>
                </div>
                <div class="box-body">
                    <canvas id="bill-overview" style="width:100%;height:400px;" height="400" width="100%"></canvas>
                </div>
            </div>
        </div>
    </div>

    <div class="row">
        <div class="col-lg-12 col-sm-12 col-md-12">
            <div class="box">
                <div class="box-header with-border">
                    <h3 class="box-title">{{ 'connected_journals'|_ }}</h3>
                </div>
                <div class="box-body">
                    {% include 'v1.list.groups' %}
                </div>
            </div>
        </div>
    </div>

{% endblock %}

{% block scripts %}
    <script type="text/javascript" nonce="{{ JS_NONCE }}">
        var billCurrencySymbol = "{{ object.data.currency.symbol }}";
        var billUri = '{{ route('chart.bill.single', [object.data.id]) }}';
    </script>
    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    <script type="text/javascript" src="v1/js/ff/bills/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
    {# required for groups.twig #}
    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
{% endblock %}