Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
            function strip(html) {
                if (bbcodePluginLoaded) {
                    // stripping out BBCode tags [...][/...]
                    return html.replace(/\[.*?\]/gi, "");
                }

                var tmp = document.createElement("div");

                // Add filter before strip
                html = filter(html);

                tmp.innerHTML = html;

                // Parse filtered HTML, without applying it to any element in DOM
                var tmp = new DOMParser().parseFromString(html, 'text/html');
                if (!tmp.body || !tmp.body.textContent) {
                    return "";
                }

                return tmp.body.textContent || tmp.body.innerText;
            }