Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function test(input) {
    var count = 0;
    var oldInput, newInput;
    testContainer.innerHTML = "<img />";
    testImage().setAttribute("alt", input);
    print("------");
    print("Test input: " + input);
    do {
        oldInput = testImage().getAttribute("alt");
        var intermediate = testContainer.innerHTML;
        print("Render: " + intermediate);
        testContainer.innerHTML = intermediate;
        if (testImage() == null) {
            print("Image disappeared...");
            break;
        }
        newInput = testImage().getAttribute("alt");
        print("New value: " + newInput);
        count++;
    } while (count < 5 && newInput != oldInput);
    if (count == 5) {
        print("Failed to achieve fixpoint");
    }
    testContainer.innerHTML = "";
}