Program: CWE-79
Project: CVE-2019-19619
Buggy source:
module github.com/documize/community

go 1.13

require (
	github.com/BurntSushi/toml v0.3.1
	github.com/andygrunwald/go-jira v1.10.0
	github.com/codegangsta/negroni v0.3.0
	github.com/denisenkom/go-mssqldb v0.0.0-20190806190131-db2462fef53b
	github.com/dgrijalva/jwt-go v3.1.0+incompatible
	github.com/documize/blackfriday v2.0.0+incompatible
	github.com/documize/glick v0.0.0-20160503134043-a8ccbef88237
	github.com/documize/html-diff v0.0.0-20160503140253-f61c192c7796
	github.com/documize/slug v1.1.1
	github.com/elazarl/go-bindata-assetfs v1.0.0
	github.com/go-sql-driver/mysql v1.4.1
	github.com/google/go-github v17.0.0+incompatible
	github.com/google/go-querystring v1.0.0 // indirect
	github.com/gorilla/handlers v1.4.0
	github.com/gorilla/mux v1.6.2
	github.com/jmoiron/sqlx v1.2.0
	github.com/jteeuwen/go-bindata v3.0.7+incompatible // indirect
	github.com/kr/pretty v0.1.0 // indirect
	github.com/lib/pq v1.2.0
	github.com/mb0/diff v0.0.0-20131118162322-d8d9a906c24d // indirect
	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d
	github.com/pkg/errors v0.8.0
	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be // indirect
	github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95 // indirect
	golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734
	golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3
	golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421
	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc
	gopkg.in/asn1-ber.v1 v1.0.0-20170511165959-379148ca0225 // indirect
	gopkg.in/cas.v2 v2.1.0
	gopkg.in/ldap.v3 v3.0.3
)


Fixed version (ground truth):
module github.com/documize/community

go 1.13

require (
	github.com/BurntSushi/toml v0.3.1
	github.com/andygrunwald/go-jira v1.10.0
	github.com/codegangsta/negroni v0.3.0
	github.com/denisenkom/go-mssqldb v0.0.0-20190806190131-db2462fef53b
	github.com/dgrijalva/jwt-go v3.1.0+incompatible
	github.com/documize/blackfriday v2.0.0+incompatible
	github.com/documize/glick v0.0.0-20160503134043-a8ccbef88237
	github.com/documize/html-diff v0.0.0-20160503140253-f61c192c7796
	github.com/documize/slug v1.1.1
	github.com/elazarl/go-bindata-assetfs v1.0.0
	github.com/go-sql-driver/mysql v1.4.1
	github.com/google/go-github v17.0.0+incompatible
	github.com/google/go-querystring v1.0.0 // indirect
	github.com/gorilla/handlers v1.4.0
	github.com/gorilla/mux v1.6.2
	github.com/jmoiron/sqlx v1.2.0
	github.com/jteeuwen/go-bindata v3.0.7+incompatible // indirect
	github.com/kr/pretty v0.1.0 // indirect
	github.com/lib/pq v1.2.0
	github.com/mb0/diff v0.0.0-20131118162322-d8d9a906c24d // indirect
	github.com/microcosm-cc/bluemonday v1.0.2
	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d
	github.com/pkg/errors v0.8.0
	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be // indirect
	github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95 // indirect
	golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734
	golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3
	golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421
	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc
	gopkg.in/asn1-ber.v1 v1.0.0-20170511165959-379148ca0225 // indirect
	gopkg.in/cas.v2 v2.1.0
	gopkg.in/ldap.v3 v3.0.3
)