Program: 26413
Project: 26413
Buggy source:
private void analyzeResponse(AttackData data,SentinelHttpMessageAtk httpMessage){
  boolean hasXss=false;
  boolean hasInput=false;
  String message="String_Node_Str";
switch (state) {
case 0:
    origTidyMsgs=util.Beautifier.getInstance().analyze(httpMessage.getRes().extractBody());
  if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
    hasInput=true;
    message+="String_Node_Str" + data.getOutput();
  }
break;
case 1:
case 2:
case 3:
case 4:
if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
hasInput=true;
message+="String_Node_Str" + data.getOutput();
}
if (hasInput && !inputReflectedInTag) {
hasXss=true;
}
break;
case 5:
case 6:
case 7:
case 8:
if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
hasInput=true;
message+="String_Node_Str" + data.getOutput();
}
if (hasInput && inputReflectedInTag) {
hasXss=true;
}
break;
case 11:
case 12:
case 14:
if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
hasInput=true;
message+="String_Node_Str" + data.getOutput();
}
}
if (state > 0) {
LinkedList<TidyMessage> msgs=util.Beautifier.getInstance().analyze(httpMessage.getRes().extractBody());
if (util.Beautifier.getInstance().hasHtmlSyntaxError(origTidyMsgs,msgs)) {
hasXss=true;
if (!message.equals("String_Node_Str")) {
message+="String_Node_Str";
}
message+="String_Node_Str" + util.Beautifier.getInstance().getMessageDiffString(origTidyMsgs,msgs);
}
}
message+="String_Node_Str";
BurpCallbacks.getInstance().print(message);
if (hasXss) {
data.setSuccess(true);
AttackResult res=new AttackResult(data.getAttackType(),"String_Node_Str" + data.getIndex(),httpMessage.getReq().getChangeParam(),true,message);
httpMessage.addAttackResult(res);
ResponseHighlight h=new ResponseHighlight(data.getOutput(),failColor);
httpMessage.getRes().addHighlight(h);
}
 else if (hasInput) {
AttackResult res=new AttackResult(AttackData.AttackType.INFO,"String_Node_Str" + data.getIndex(),httpMessage.getReq().getChangeParam(),true,message);
httpMessage.addAttackResult(res);
ResponseHighlight h=new ResponseHighlight(data.getOutput(),failColor);
httpMessage.getRes().addHighlight(h);
}
 else {
data.setSuccess(false);
AttackResult res=new AttackResult(AttackData.AttackType.NONE,"String_Node_Str" + data.getIndex(),httpMessage.getReq().getChangeParam(),false,null);
httpMessage.addAttackResult(res);
}
}

Fixed version (ground truth):
private void analyzeResponse(AttackData data,SentinelHttpMessageAtk httpMessage){
  boolean hasXss=false;
  boolean hasInput=false;
  String message="String_Node_Str";
switch (state) {
case 0:
    origTidyMsgs=util.Beautifier.getInstance().analyze(httpMessage.getRes().extractBody());
  if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
    hasInput=true;
    message+="String_Node_Str" + data.getOutput();
  }
break;
case 1:
case 2:
case 3:
case 4:
if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
hasInput=true;
message+="String_Node_Str" + data.getOutput();
}
if (hasInput && !inputReflectedInTag) {
hasXss=true;
}
break;
case 7:
case 8:
if (httpMessage.getRes().extractBody().contains(data.getOutput()) && inputReflectedInTag) {
hasInput=true;
message+="String_Node_Str" + data.getOutput();
}
break;
case 11:
if (httpMessage.getRes().extractBody().contains(data.getOutput())) {
hasInput=true;
message+="String_Node_Str" + data.getOutput();
}
}
if (state > 0) {
LinkedList<TidyMessage> msgs=util.Beautifier.getInstance().analyze(httpMessage.getRes().extractBody());
if (util.Beautifier.getInstance().hasHtmlSyntaxError(origTidyMsgs,msgs)) {
hasXss=true;
if (!message.equals("String_Node_Str")) {
message+="String_Node_Str";
}
message+="String_Node_Str" + util.Beautifier.getInstance().getMessageDiffString(origTidyMsgs,msgs);
}
}
message+="String_Node_Str";
if (hasXss) {
data.setSuccess(true);
AttackResult res=new AttackResult(data.getAttackType(),"String_Node_Str" + data.getIndex(),httpMessage.getReq().getChangeParam(),true,message);
httpMessage.addAttackResult(res);
ResponseHighlight h=new ResponseHighlight(data.getOutput(),failColor);
httpMessage.getRes().addHighlight(h);
}
 else if (hasInput) {
AttackResult res=new AttackResult(AttackData.AttackType.INFO,"String_Node_Str" + data.getIndex(),httpMessage.getReq().getChangeParam(),true,message);
httpMessage.addAttackResult(res);
ResponseHighlight h=new ResponseHighlight(data.getOutput(),failColor);
httpMessage.getRes().addHighlight(h);
}
 else {
data.setSuccess(false);
AttackResult res=new AttackResult(AttackData.AttackType.NONE,"String_Node_Str" + data.getIndex(),httpMessage.getReq().getChangeParam(),false,null);
httpMessage.addAttackResult(res);
}
}