Program: CWE-22
Project: CVE-2019-12277
Buggy source:
<?xml version="1.0"?>
<doc>
    <assembly>
        <name>Core</name>
    </assembly>
    <members>
        <member name="M:Core.Api.AssetsController.Get(System.Int32,System.String,System.String)">
            <summary>
            Get list of assets - user saved images and files
            </summary>
            <param name="page">Page number</param>
            <param name="filter">filterImages or filterAttachments</param>
            <param name="search">Search term</param>
            <returns>Model containing collection of assets and Pager object</returns>
        </member>
        <member name="M:Core.Api.AssetsController.Pick(System.String,System.String,System.String)">
            <summary>
            Select an asset in the File Manager to include in the post
            </summary>
            <param name="type">Type of asset (post cover, logo, avatar or post image/attachment)</param>
            <param name="asset">Selected asset</param>
            <param name="post">Post ID</param>
            <returns>Asset Item</returns>
        </member>
        <member name="M:Core.Api.AssetsController.Upload(System.Collections.Generic.ICollection{Microsoft.AspNetCore.Http.IFormFile})">
            <summary>
            Upload file(s) to user data store
            </summary>
            <param name="files">Selected files</param>
            <returns>Success or internal error</returns>
        </member>
        <member name="M:Core.Api.AssetsController.Remove(System.String)">
            <summary>
            Remove file from user data store, authentication required
            </summary>
            <param name="url">Relative URL of the file to remove</param>
            <returns></returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Get(System.Int32)">
            <summary>
            Get list of blog authors
            </summary>
            <param name="page">Page number</param>
            <returns>List of authors</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Get(System.String)">
            <summary>
            Get single author by name
            </summary>
            <param name="author">Author name used during registration</param>
            <returns>Author object</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Post(Core.Data.Models.RegisterModel)">
            <summary>
            Register new author. Authorized admins only.
            </summary>
            <param name="model">Author model</param>
            <returns>Created Author object</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Update(Core.Data.Author)">
            <summary>
            Update author
            </summary>
            <param name="model">Author model</param>
            <returns>Success or 500 error</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.ChangePwd(Core.Data.Models.ChangePasswordModel)">
            <summary>
            Change author password. Authorized users only.
            </summary>
            <param name="model">Author model</param>
            <returns>Success or 500 error</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Delete(System.String)">
            <summary>
            Delete author, from membership, database and file system. Admin only.
            </summary>
            <param name="id">Author ID</param>
            <returns>Success or 500 error</returns>
        </member>
        <member name="M:Core.Api.PostsController.Search(System.String,System.String,System.String,System.Int32)">
            <summary>
            Search blog posts by term
            </summary>
            <param name="term">Search term</param>
            <param name="author">Author</param>
            <param name="include">Posts to include: all by default; F - featured, D - drafts, P - published</param>
            <param name="page">Page number</param>
            <returns>Model with list of posts and pager</returns>
        </member>
        <member name="M:Core.Api.PostsController.Get(System.String,System.String,System.String,System.Int32)">
            <summary>
            Get list of blog posts
            </summary>
            <param name="author">Post author</param>
            <param name="category">Post category</param>
            <param name="include">Posts to include: all by default; F - featured, D - drafts, P - published</param>
            <param name="page">Page number</param>
            <returns>Model with list of posts and pager</returns>
        </member>
        <member name="M:Core.Api.PostsController.GetPost(System.Int32)">
            <summary>
            Get single post by ID
            </summary>
            <param name="id">Post ID</param>
            <returns>Post item</returns>
        </member>
        <member name="M:Core.Api.PostsController.Publish(System.Int32,System.String)">
            <summary>
            Set post as published or draft
            </summary>
            <param name="id">Post ID</param>
            <param name="flag">Flag; P - publish, U - unpublish</param>
            <returns>Success of failure</returns>
        </member>
        <member name="M:Core.Api.PostsController.Feature(System.Int32,System.String)">
            <summary>
            Set post as featured
            </summary>
            <param name="id">Post ID</param>
            <param name="flag">Flag; F - featured, U - remove from featured</param>
            <returns></returns>
        </member>
        <member name="M:Core.Api.PostsController.Post(Core.Data.PostItem)">
            <summary>
            Save blog post
            </summary>
            <param name="post">Post item</param>
            <returns>Saved post item</returns>
        </member>
        <member name="M:Core.Api.PostsController.Remove(System.Int32)">
            <summary>
            Remove post item
            </summary>
            <param name="id">Post ID</param>
            <returns>Success or failure</returns>
        </member>
        <member name="M:Core.Api.SettingsController.GetCultures">
            <summary>
            Get list of cultures
            </summary>
            <returns>List of supported languages</returns>
        </member>
        <member name="M:Core.Api.SettingsController.Get">
            <summary>
            Get blog settings
            </summary>
            <returns>Blog settings</returns>
        </member>
        <member name="M:Core.Api.SettingsController.Post(Core.Data.BlogItem)">
            <summary>
            Save blog settings
            </summary>
            <param name="model">Blog settings item</param>
            <returns>Saved blog item</returns>
        </member>
        <member name="M:Core.Api.ThemesController.Get(System.Int32)">
            <summary>
            Get list of themes
            </summary>
            <param name="page">Page number</param>
            <returns>List of themes</returns>
        </member>
        <member name="M:Core.Api.ThemesController.Put(System.String)">
            <summary>
            Set theme as current for a blog
            </summary>
            <param name="id">Theme ID</param>
            <returns>Success or failure</returns>
        </member>
        <member name="M:Core.Api.ThemesController.Delete(System.String)">
            <summary>
            Remove and unistall theme from the blog
            </summary>
            <param name="id">Theme ID</param>
            <returns>Success or failure</returns>
        </member>
        <member name="P:Core.Data.Author.Id">
            <summary>
            Author ID
            </summary>
        </member>
        <member name="M:Core.StringExtensions.ExtractTitle(System.String)">
            <summary>
            Should extract title (file name) from file path or Url
            </summary>
            <param name="str">c:\foo\test.png</param>
            <returns>test.png</returns>
        </member>
        <member name="M:Core.StringExtensions.ToSlug(System.String)">
            <summary>
            Converts title to valid URL slug
            </summary>
            <returns>Slug</returns>
        </member>
        <member name="M:Core.StringExtensions.ToDescription(System.String)">
            <summary>
            Converts post body to post description
            </summary>
            <param name="str">HTML post body</param>
            <returns>Post decription as plain text</returns>
        </member>
    </members>
</doc>


Fixed version (ground truth):
<?xml version="1.0"?>
<doc>
    <assembly>
        <name>Core</name>
    </assembly>
    <members>
        <member name="M:Core.Api.AssetsController.Get(System.Int32,System.String,System.String)">
            <summary>
            Get list of assets - user saved images and files
            </summary>
            <param name="page">Page number</param>
            <param name="filter">filterImages or filterAttachments</param>
            <param name="search">Search term</param>
            <returns>Model containing collection of assets and Pager object</returns>
        </member>
        <member name="M:Core.Api.AssetsController.Pick(System.String,System.String,System.String)">
            <summary>
            Select an asset in the File Manager to include in the post
            </summary>
            <param name="type">Type of asset (post cover, logo, avatar or post image/attachment)</param>
            <param name="asset">Selected asset</param>
            <param name="post">Post ID</param>
            <returns>Asset Item</returns>
        </member>
        <member name="M:Core.Api.AssetsController.Upload(System.Collections.Generic.ICollection{Microsoft.AspNetCore.Http.IFormFile})">
            <summary>
            Upload file(s) to user data store, authentication required
            </summary>
            <param name="files">Selected files</param>
            <returns>Success or internal error</returns>
        </member>
        <member name="M:Core.Api.AssetsController.Remove(System.String)">
            <summary>
            Remove file from user data store, authentication required
            </summary>
            <param name="url">Relative URL of the file to remove</param>
            <returns></returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Get(System.Int32)">
            <summary>
            Get list of blog authors
            </summary>
            <param name="page">Page number</param>
            <returns>List of authors</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Get(System.String)">
            <summary>
            Get single author by name
            </summary>
            <param name="author">Author name used during registration</param>
            <returns>Author object</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Post(Core.Data.Models.RegisterModel)">
            <summary>
            Register new author. Authorized admins only.
            </summary>
            <param name="model">Author model</param>
            <returns>Created Author object</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Update(Core.Data.Author)">
            <summary>
            Update author
            </summary>
            <param name="model">Author model</param>
            <returns>Success or 500 error</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.ChangePwd(Core.Data.Models.ChangePasswordModel)">
            <summary>
            Change author password. Authorized users only.
            </summary>
            <param name="model">Author model</param>
            <returns>Success or 500 error</returns>
        </member>
        <member name="M:Core.Api.AuthorsController.Delete(System.String)">
            <summary>
            Delete author, from membership, database and file system. Admin only.
            </summary>
            <param name="id">Author ID</param>
            <returns>Success or 500 error</returns>
        </member>
        <member name="M:Core.Api.PostsController.Search(System.String,System.String,System.String,System.Int32)">
            <summary>
            Search blog posts by term
            </summary>
            <param name="term">Search term</param>
            <param name="author">Author</param>
            <param name="include">Posts to include: all by default; F - featured, D - drafts, P - published</param>
            <param name="page">Page number</param>
            <returns>Model with list of posts and pager</returns>
        </member>
        <member name="M:Core.Api.PostsController.Get(System.String,System.String,System.String,System.Int32)">
            <summary>
            Get list of blog posts
            </summary>
            <param name="author">Post author</param>
            <param name="category">Post category</param>
            <param name="include">Posts to include: all by default; F - featured, D - drafts, P - published</param>
            <param name="page">Page number</param>
            <returns>Model with list of posts and pager</returns>
        </member>
        <member name="M:Core.Api.PostsController.GetPost(System.Int32)">
            <summary>
            Get single post by ID
            </summary>
            <param name="id">Post ID</param>
            <returns>Post item</returns>
        </member>
        <member name="M:Core.Api.PostsController.Publish(System.Int32,System.String)">
            <summary>
            Set post as published or draft
            </summary>
            <param name="id">Post ID</param>
            <param name="flag">Flag; P - publish, U - unpublish</param>
            <returns>Success of failure</returns>
        </member>
        <member name="M:Core.Api.PostsController.Feature(System.Int32,System.String)">
            <summary>
            Set post as featured
            </summary>
            <param name="id">Post ID</param>
            <param name="flag">Flag; F - featured, U - remove from featured</param>
            <returns></returns>
        </member>
        <member name="M:Core.Api.PostsController.Post(Core.Data.PostItem)">
            <summary>
            Save blog post
            </summary>
            <param name="post">Post item</param>
            <returns>Saved post item</returns>
        </member>
        <member name="M:Core.Api.PostsController.Remove(System.Int32)">
            <summary>
            Remove post item
            </summary>
            <param name="id">Post ID</param>
            <returns>Success or failure</returns>
        </member>
        <member name="M:Core.Api.SettingsController.GetCultures">
            <summary>
            Get list of cultures
            </summary>
            <returns>List of supported languages</returns>
        </member>
        <member name="M:Core.Api.SettingsController.Get">
            <summary>
            Get blog settings
            </summary>
            <returns>Blog settings</returns>
        </member>
        <member name="M:Core.Api.SettingsController.Post(Core.Data.BlogItem)">
            <summary>
            Save blog settings
            </summary>
            <param name="model">Blog settings item</param>
            <returns>Saved blog item</returns>
        </member>
        <member name="M:Core.Api.ThemesController.Get(System.Int32)">
            <summary>
            Get list of themes
            </summary>
            <param name="page">Page number</param>
            <returns>List of themes</returns>
        </member>
        <member name="M:Core.Api.ThemesController.Put(System.String)">
            <summary>
            Set theme as current for a blog
            </summary>
            <param name="id">Theme ID</param>
            <returns>Success or failure</returns>
        </member>
        <member name="M:Core.Api.ThemesController.Delete(System.String)">
            <summary>
            Remove and unistall theme from the blog
            </summary>
            <param name="id">Theme ID</param>
            <returns>Success or failure</returns>
        </member>
        <member name="P:Core.Data.Author.Id">
            <summary>
            Author ID
            </summary>
        </member>
        <member name="M:Core.StringExtensions.ExtractTitle(System.String)">
            <summary>
            Should extract title (file name) from file path or Url
            </summary>
            <param name="str">c:\foo\test.png</param>
            <returns>test.png</returns>
        </member>
        <member name="M:Core.StringExtensions.ToSlug(System.String)">
            <summary>
            Converts title to valid URL slug
            </summary>
            <returns>Slug</returns>
        </member>
        <member name="M:Core.StringExtensions.ToDescription(System.String)">
            <summary>
            Converts post body to post description
            </summary>
            <param name="str">HTML post body</param>
            <returns>Post decription as plain text</returns>
        </member>
    </members>
</doc>