Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    function cb(err: Error, _res?: string) {
      expect(err).toBeTruthy();
      expect(err.message).toMatch(
        buildRegEx(`
var tR='',__l,__lP,include=E.include.bind(E),includeFile=E.includeFile.bind(E)
function layout(p,d){__l=p;__lP=d}
tR+='Hi '
tR+=E.e(badSyntax(=!)
if(__l)tR=await includeFile(__l,Object.assign(it,{body:tR},__lP))
if(cb){cb(null,tR)} return tR
`)
      );
      done();
    }

    renderFile(errFilePath, { name: "Ada Lovelace", async: true }, cb);
  });