Language: JavaScript
Label: vulnerable
CWE: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Code:
		setFullpageOnInit: function(html)
		{
			this.fullpageDoctype = html.match(/^<\!doctype[^>]*>/i);
			if (this.fullpageDoctype && this.fullpageDoctype.length == 1)
			{
				html = html.replace(/^<\!doctype[^>]*>/i, '');
			}

			html = this.cleanSavePreCode(html, true);
			html = this.cleanConverters(html);
			html = this.cleanEmpty(html);
            html = this.sanitizeHTML(html);

			this.$editor.html(html);

			this.setNonEditable();
			this.setSpansVerified();
			this.sync();
		},