Language: Java
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public Optional<GroupModification> update(int listId, GroupModification modification) {

        if(groupRepository.getOptionalById(listId).isEmpty() || CollectionUtils.isEmpty(modification.getItems())) {
            return Optional.empty();
        }

        List<String> existingValues = groupRepository.getAllValuesIncludingNotActive(listId);
        List<GroupMemberModification> notPresent = modification.getItems().stream()
            .filter(i -> i.getId() == null && !existingValues.contains(i.getValue().strip().toLowerCase()))
            .distinct()
            .collect(Collectors.toList());

        if(!notPresent.isEmpty()) {
            var insertResult = insertMembers(listId, notPresent);
            if(!insertResult.isSuccess()) {
                var error = Objects.requireNonNull(insertResult.getFirstErrorOrNull());
                throw new DuplicateGroupItemException(error.getDescription());
            }
        }
        groupRepository.update(listId, modification.getName(), modification.getDescription());
        return loadComplete(listId);
    }