Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function noxss_html($html) {
		if (!is_string($html) || is_blank($html))
			return "";

		// Convert encoding to UTF-8
		$html = mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8');

		// Throw loadHTML() parsing errors
		$err_mode = libxml_use_internal_errors(false);
		$php_reporting = error_reporting(0);

		try {
			$dom = new \DOMDocument();
			if ($dom->loadHTML("<html>".$html."</html>", LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD | LIBXML_NOBLANKS | LIBXML_NOWARNING | LIBXML_NOERROR) === false)
				return "";

			$banned_elements = ['script', 'iframe', 'embed'];
			$remove_elements = [];

			$elements = $dom->getElementsByTagName('*');

			if (is_object($elements) && $elements->length>0) {
				foreach($elements as $e) {
					if (in_array($e->nodeName, $banned_elements)) {
						$remove_elements[] = $e;
						continue;
					}

					if (!$e->hasAttributes())
						continue;

					// remove on* HTML event attributes
					foreach ($e->attributes as $attr) {
						if (substr($attr->nodeName,0,2) == "on")
							$e->removeAttribute($attr->nodeName);
					}
				}

				// Remove banned elements
				foreach($remove_elements as $e)
					$e->parentNode->removeChild($e);

				// Return sanitised HTML
				$html = str_replace(['<html>', '</html>'], '', $dom->saveHTML());
			}
		} catch (Exception $e) {
			$html = "";
		}

		// restore error mode
		libxml_use_internal_errors($err_mode);
		error_reporting($php_reporting);

		return is_string($html) ? $html : "";
	}