Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.palette[y]={red:m,green:B,blue:A,quad:g}}}};BmpDecoder.prototype.parseBGR=function(){this.pos=this.offset;try{var h="bit"+this.bitPP,y=document.createElement("canvas").getContext("2d").createImageData(this.width,this.height);this.imageData=y;this.data=y.data;this[h]()}catch(A){console.log("bit decode error:"+A)}};