Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function testFile()
	{
		$file = __DIR__ . '/fixtures/download.txt';

		$response = Response::file($file);

		$this->assertSame('text/plain', $response->type());
		$this->assertSame(200, $response->code());
		$this->assertSame('test', $response->body());

		$response = Response::file($file, [
			'code'    => '201',
			'headers' => [
				'Pragma' => 'no-cache'
			]
		]);

		$this->assertSame('text/plain', $response->type());
		$this->assertSame(201, $response->code());
		$this->assertSame('test', $response->body());
		$this->assertSame([
			'Pragma' => 'no-cache'
		], $response->headers());
	}