Program: CWE-79
Project: CVE-2017-11593
Buggy source:
{
  "name": "Markdown Preview Plus",
  "version": "0.5.6",
  "manifest_version": 2,

  "description": "Converts and previews markdown files (.md, .markdown) to HTML right inside Chrome.",
  "icons": {
    "128": "images/icon.png",
    "48": "images/icon.png",
    "16": "images/icon.png"
  },

  "content_scripts": [
    {
      "matches": [
        "file://*/*.md*",
        "file://*/*.MD*",
        "file://*/*.text",
        "file://*/*.markdown*",
        "file://*/*.mdown*",
        "file://*/*.txt*",
        "file://*/*.mkd*",
        "file://*/*.rst*",
        "*://*/*.md*",
        "*://*/*.MD*",
        "*://*/*.text",
        "*://*/*.markdown*",
        "*://*/*.mdown*",
        "*://*/*.txt*",
        "*://*/*.mkd*",
        "*://*/*.rst*"
      ],
      "js": [
          "js/jquery.js",
          "js/marked.js",
          "js/highlight.js",
          "js/config.js",
          "js/markdownify.js"
      ]
    }
  ],
  "permissions": [
      "storage",
      "activeTab",
      "pageCapture",
      "downloads",
      "clipboardWrite",
      "<all_urls>"
  ],
  "web_accessible_resources": [
      "bootstrap.css",
      "theme/Clearness.css",
      "theme/ClearnessDark.css",
      "theme/Github.css",
      "theme/TopMarks.css",
      "theme/i/cal.png",
      "theme/i/compass.png",
      "theme/i/doc.png",
      "theme/i/email.png",
      "theme/i/folder.png",
      "js/highlight.js",
      "js/popup.js",
      "js/config.js",
      "js/runMathJax.js",
      "js/marked.js",
      "js/options.js"
  ],
  "browser_action": {
      "default_icon" : "images/icon.png",
      "default_title" : "Markdown Preview Plus",
      "default_popup" : "popup.html"
  },
  "content_security_policy": "script-src 'self' 'unsafe-eval' https://cdn.mathjax.org/; object-src 'self'",
  "options_page": "options.html"
}


Fixed version (ground truth):
{
  "name": "Markdown Preview Plus",
  "version": "0.5.7",
  "manifest_version": 2,

  "description": "Converts and previews markdown files (.md, .markdown) to HTML right inside Chrome.",
  "icons": {
    "128": "images/icon.png",
    "48": "images/icon.png",
    "16": "images/icon.png"
  },

  "content_scripts": [
    {
      "matches": [
        "file://*/*.md*",
        "file://*/*.MD*",
        "file://*/*.text",
        "file://*/*.markdown*",
        "file://*/*.mdown*",
        "file://*/*.txt*",
        "file://*/*.mkd*",
        "file://*/*.rst*",
        "*://*/*.md*",
        "*://*/*.MD*",
        "*://*/*.text",
        "*://*/*.markdown*",
        "*://*/*.mdown*",
        "*://*/*.txt*",
        "*://*/*.mkd*",
        "*://*/*.rst*"
      ],
      "js": [
          "js/jquery.js",
          "js/marked.js",
          "js/highlight.js",
          "js/config.js",
          "js/markdownify.js"
      ]
    }
  ],
  "permissions": [
      "storage",
      "activeTab",
      "pageCapture",
      "downloads",
      "clipboardWrite",
      "<all_urls>"
  ],
  "web_accessible_resources": [
      "bootstrap.css",
      "theme/Clearness.css",
      "theme/ClearnessDark.css",
      "theme/Github.css",
      "theme/TopMarks.css",
      "theme/i/cal.png",
      "theme/i/compass.png",
      "theme/i/doc.png",
      "theme/i/email.png",
      "theme/i/folder.png",
      "js/highlight.js",
      "js/popup.js",
      "js/config.js",
      "js/runMathJax.js",
      "js/marked.js",
      "js/options.js"
  ],
  "browser_action": {
      "default_icon" : "images/icon.png",
      "default_title" : "Markdown Preview Plus",
      "default_popup" : "popup.html"
  },
  "content_security_policy": "script-src 'self' 'unsafe-eval' https://cdn.mathjax.org/; object-src 'self'",
  "options_page": "options.html"
}