Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                    $purfied_job_url       = $hp->purify($triggered_job_url);
                    $purified_information .= '<a href="' . $purfied_job_url . '">' . $purfied_job_url . '</a><br>';
                }
                $purified_information .= '</div>';
            }

            if ($log->getStatusCode() !== null) {
                $purified_information .= '<div class="hook-log-branch-source-status">';
                $purified_information .= '<h4>' . dgettext("tuleap-hudson_git", "Branch source plugin:") . '</h4>';
                $purified_information .= $log->getStatusCode();
                $purified_information .= '</div>';
            }

            $this->hooklogs[] = new WebhookLogPresenter($log->getFormattedPushDate(), $purified_information);
        }