Program: CWE-79
Project: CVE-2021-41169
Buggy source:
<!DOCTYPE html>
<!--[if lt IE 7]>      <html class="no-js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
<!--[if IE 7]>         <html class="no-js lt-ie9 lt-ie8"> <![endif]-->
<!--[if IE 8]>         <html class="no-js lt-ie9"> <![endif]-->
<!--[if gt IE 8]><!-->
<html class="no-js"> <!--<![endif]-->
<head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <title>{{ name }}</title>
    <meta name="description" content="">
    <meta name="viewport" content="width=device-width">

    <!-- Place favicon.ico and apple-touch-icon.png in the root directory -->

    {% block stylesheets %}
    <link rel="stylesheet" href="/bundles/suluadmin/dist/login.min.1614246819288.css">

    <link rel="stylesheet" type="text/css" href="/bundles/suluadmin/css/main.css"/>
    {% endblock stylesheets %}
</head>
<body>
    <div id="main" class="login">
        {% block main %}
        <div data-aura-component="login@suluadmin"
             data-aura-login-check="{{ path('sulu_admin.login_check') }}"
             data-aura-reset-mail-url="{{ path('sulu_security.reset_password.email') }}"
             data-aura-login-url="{{ path('sulu_admin.login') }}"
             data-aura-csrf-token="{{ csrf_token('authenticate') }}"
             {% if token is defined %}
                data-aura-reset-token="{{ token }}"
                data-aura-reset-mode="true"
             {% endif %}
             data-aura-reset-url="{{ path('sulu_security.reset_password.reset') }}"></div>

        <div id="labels-container" class='login-label-container' data-aura-component="labels@suluadmin"></div>
        {% endblock main %}
    </div>
    <script type="text/javascript">
        {% autoescape false %}
        var SULU = {
            debug: false,
            locales: {{ locales | json_encode }},
            translatedLocales: {{ translated_locales | json_encode }},
            translations: {{ translations | json_encode }},
            fallbackLocale: '{{ fallback_locale }}'
        };
        {% endautoescape %}
    </script>

    {% block javascripts %}
    <script data-main="/bundles/suluadmin/dist/login.min.1614246819288" src="/bundles/suluadmin/js/vendor/husky/husky.min.js?v=1614246819288"></script>
    {% endblock javascripts %}
</body>
</html>


Fixed version (ground truth):
<!DOCTYPE html>
<!--[if lt IE 7]>      <html class="no-js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
<!--[if IE 7]>         <html class="no-js lt-ie9 lt-ie8"> <![endif]-->
<!--[if IE 8]>         <html class="no-js lt-ie9"> <![endif]-->
<!--[if gt IE 8]><!-->
<html class="no-js"> <!--<![endif]-->
<head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    <title>{{ name }}</title>
    <meta name="description" content="">
    <meta name="viewport" content="width=device-width">

    <!-- Place favicon.ico and apple-touch-icon.png in the root directory -->

    {% block stylesheets %}
    <link rel="stylesheet" href="/bundles/suluadmin/dist/login.min.1634826923308.css">

    <link rel="stylesheet" type="text/css" href="/bundles/suluadmin/css/main.css"/>
    {% endblock stylesheets %}
</head>
<body>
    <div id="main" class="login">
        {% block main %}
        <div data-aura-component="login@suluadmin"
             data-aura-login-check="{{ path('sulu_admin.login_check') }}"
             data-aura-reset-mail-url="{{ path('sulu_security.reset_password.email') }}"
             data-aura-login-url="{{ path('sulu_admin.login') }}"
             data-aura-csrf-token="{{ csrf_token('authenticate') }}"
             {% if token is defined %}
                data-aura-reset-token="{{ token }}"
                data-aura-reset-mode="true"
             {% endif %}
             data-aura-reset-url="{{ path('sulu_security.reset_password.reset') }}"></div>

        <div id="labels-container" class='login-label-container' data-aura-component="labels@suluadmin"></div>
        {% endblock main %}
    </div>
    <script type="text/javascript">
        {% autoescape false %}
        var SULU = {
            debug: false,
            locales: {{ locales | json_encode }},
            translatedLocales: {{ translated_locales | json_encode }},
            translations: {{ translations | json_encode }},
            fallbackLocale: '{{ fallback_locale }}'
        };
        {% endautoescape %}
    </script>

    {% block javascripts %}
    <script data-main="/bundles/suluadmin/dist/login.min.1634826923308" src="/bundles/suluadmin/js/vendor/husky/husky.min.js?v=1634826923308"></script>
    {% endblock javascripts %}
</body>
</html>