Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.parseHeader=function(){var g=this.buffer;this.fileSize=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.reserved=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.offset=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.headerSize=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.width=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];
this.pos+=4;this.height=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.planes=g[this.pos+1]<<8|g[this.pos];this.pos+=2;this.bitPP=g[this.pos+1]<<8|g[this.pos];this.pos+=2;this.compress=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.rawSize=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.hr=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.vr=g[this.pos+3]<<24|g[this.pos+
2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.colors=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;this.importantColors=g[this.pos+3]<<24|g[this.pos+2]<<16|g[this.pos+1]<<8|g[this.pos];this.pos+=4;16===this.bitPP&&this.is_with_alpha&&(this.bitPP=15);if(15>this.bitPP){g=0===this.colors?1<<this.bitPP:this.colors;this.palette=Array(g);for(var y=0;y<g;y++){var z=this.buffer[this.pos++],B=this.buffer[this.pos++],m=this.buffer[this.pos++],h=this.buffer[this.pos++];
this.palette[y]={red:m,green:B,blue:z,quad:h}}}};BmpDecoder.prototype.parseBGR=function(){this.pos=this.offset;try{var g="bit"+this.bitPP,y=document.createElement("canvas").getContext("2d").createImageData(this.width,this.height);this.imageData=y;this.data=y.data;this[g]()}catch(z){console.log("bit decode error:"+z)}};