Program: CWE-79
Project: CVE-2017-15570
Buggy source:
<%= form_tag({}, :data => {:cm_url => time_entries_context_menu_path}) do -%>
<%= hidden_field_tag 'back_url', url_for(:params => request.query_parameters), :id => nil %>
<div class="autoscroll">
<table class="list odd-even time-entries">
<thead>
  <tr>
    <th class="checkbox hide-when-print">
      <%= check_box_tag 'check_all', '', false, :class => 'toggle-selection',
        :title => "#{l(:button_check_all)}/#{l(:button_uncheck_all)}" %>
    </th>
    <% @query.inline_columns.each do |column| %>
      <%= column_header(@query, column) %>
    <% end %>
    <th></th>
  </tr>
</thead>
<tbody>
<% grouped_query_results(entries, @query) do |entry, group_name, group_count, group_totals| -%>
  <% if group_name %>
    <% reset_cycle %>
    <tr class="group open">
      <td colspan="<%= @query.inline_columns.size + 2 %>">
        <span class="expander" onclick="toggleRowGroup(this);">&nbsp;</span>
        <span class="name"><%= group_name %></span>
        <% if group_count %>
        <span class="count"><%= group_count %></span>
        <% end %>
        <span class="totals"><%= group_totals %></span>
        <%= link_to_function("#{l(:button_collapse_all)}/#{l(:button_expand_all)}",
                             "toggleAllRowGroups(this)", :class => 'toggle-all') %>
      </td>
    </tr>
  <% end %>
  <tr id="time-entry-<%= entry.id %>" class="time-entry <%= cycle("odd", "even") %> hascontextmenu">
    <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", entry.id, false, :id => nil) %></td>
    <%= raw @query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, entry)}</td>"}.join %>
    <td class="buttons">
    <% if entry.editable_by?(User.current) -%>
        <%= link_to l(:button_edit), edit_time_entry_path(entry),
                    :title => l(:button_edit),
                    :class => 'icon-only icon-edit' %>
        <%= link_to l(:button_delete), time_entry_path(entry),
                    :data => {:confirm => l(:text_are_you_sure)},
                    :method => :delete,
                    :title => l(:button_delete),
                    :class => 'icon-only icon-del' %>
    <% end -%>
    </td>
  </tr>
  <% @query.block_columns.each do |column|
       if (text = column_content(column, issue)) && text.present? -%>
  <tr class="<%= current_cycle %>">
    <td colspan="<%= @query.inline_columns.size + 1 %>" class="<%= column.css_classes %>">
    <% if query.block_columns.count > 1 %>
      <span><%= column.caption %></span>
    <% end %>
    <%= text %>
    </td>
  </tr>
  <% end -%>
  <% end -%>
<% end -%>
</tbody>
</table>
</div>
<% end -%>

<%= context_menu %>


Fixed version (ground truth):
<%= form_tag({}, :data => {:cm_url => time_entries_context_menu_path}) do -%>
<%= hidden_field_tag 'back_url', url_for(:params => request.query_parameters), :id => nil %>
<div class="autoscroll">
<table class="list odd-even time-entries">
<thead>
  <tr>
    <th class="checkbox hide-when-print">
      <%= check_box_tag 'check_all', '', false, :class => 'toggle-selection',
        :title => "#{l(:button_check_all)}/#{l(:button_uncheck_all)}" %>
    </th>
    <% @query.inline_columns.each do |column| %>
      <%= column_header(@query, column) %>
    <% end %>
    <th></th>
  </tr>
</thead>
<tbody>
<% grouped_query_results(entries, @query) do |entry, group_name, group_count, group_totals| -%>
  <% if group_name %>
    <% reset_cycle %>
    <tr class="group open">
      <td colspan="<%= @query.inline_columns.size + 2 %>">
        <span class="expander" onclick="toggleRowGroup(this);">&nbsp;</span>
        <span class="name"><%= group_name %></span>
        <% if group_count %>
        <span class="count"><%= group_count %></span>
        <% end %>
        <span class="totals"><%= group_totals %></span>
        <%= link_to_function("#{l(:button_collapse_all)}/#{l(:button_expand_all)}",
                             "toggleAllRowGroups(this)", :class => 'toggle-all') %>
      </td>
    </tr>
  <% end %>
  <tr id="time-entry-<%= entry.id %>" class="time-entry <%= cycle("odd", "even") %> hascontextmenu">
    <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", entry.id, false, :id => nil) %></td>
    <% @query.inline_columns.each do |column| %>
    <%= content_tag('td', column_content(column, entry), :class => column.css_classes) %>
    <% end %>
    <td class="buttons">
    <% if entry.editable_by?(User.current) -%>
        <%= link_to l(:button_edit), edit_time_entry_path(entry),
                    :title => l(:button_edit),
                    :class => 'icon-only icon-edit' %>
        <%= link_to l(:button_delete), time_entry_path(entry),
                    :data => {:confirm => l(:text_are_you_sure)},
                    :method => :delete,
                    :title => l(:button_delete),
                    :class => 'icon-only icon-del' %>
    <% end -%>
    </td>
  </tr>
  <% @query.block_columns.each do |column|
       if (text = column_content(column, issue)) && text.present? -%>
  <tr class="<%= current_cycle %>">
    <td colspan="<%= @query.inline_columns.size + 1 %>" class="<%= column.css_classes %>">
    <% if query.block_columns.count > 1 %>
      <span><%= column.caption %></span>
    <% end %>
    <%= text %>
    </td>
  </tr>
  <% end -%>
  <% end -%>
<% end -%>
</tbody>
</table>
</div>
<% end -%>

<%= context_menu %>