Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit1=function(){for(var g=Math.ceil(this.width/8),y=g%4,z=this.height-1;0<=z;z--){for(var B=0;B<g;B++)for(var m=this.buffer[this.pos++],h=z*this.width*4+32*B,c=0;8>c;c++)if(8*B+c<this.width){var a=this.palette[m>>7-c&1];this.data[h+4*c]=a.red;this.data[h+4*c+1]=a.green;this.data[h+4*c+2]=a.blue;this.data[h+4*c+3]=255}else break;0!=y&&(this.pos+=4-y)}};