Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit32=function(){for(var h=this.height-1;0<=h;h--)for(var y=0;y<this.width;y++){var A=this.buffer[this.pos++],B=this.buffer[this.pos++],m=this.buffer[this.pos++],g=this.buffer[this.pos++],b=h*this.width*4+4*y;this.data[b]=m;this.data[b+1]=B;this.data[b+2]=A;this.data[b+3]=g}};BmpDecoder.prototype.getData=function(){return this.data};var __extends=this&&this.__extends||function(h,y){function A(){this.constructor=h}for(var B in y)y.hasOwnProperty(B)&&(h[B]=y[B]);h.prototype=null===y?Object.create(y):(A.prototype=y.prototype,new A)},com;