Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function markdown(){
		$this->markdownEnable = true;
		
		// 保护markdown内容不受XUBBP解析器干扰
		
		/*urltxt 文本链接*/
		$this->parse['!^(.*?)((?:https?|ftps?|rtsp)\://[a-zA-Z0-9\.\,\?\!\(\)\[\]\@\/\:\_\;\+\&\%\*\=\~\^\#\-]+)(.*)$!is'] = array(array(1, 3), 'mdlink', array(2));
		
		/*mailtxt 文本电子邮件地址*/
		$this->parse['!^(.*?)((?:mailto:)?[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z]{2,4})(.*)$!is'] = array(array(1, 3), 'mdpre', array(2));
		
		// 添加新的匹配规则
		$parseHead = [
            /*mdcode markdown代码高亮*/
            '!^(^|.*?\n)( *)(`{3,})( *[^`\n]+?)?( *\n.*?\n *)\3( *\n.*| *$)$!is' => array(array(1, 6), 'mdcode', array(4, 5, 3, 2)),

            /*code 代码高亮（标记独占一行，高优先级）*/
            '!^(^|.*?\n+)\[code(?:=([^\]]*))?\](\n+.*?\n+)\[/code\](\n+.*|$)$!is' => array(array(1, 4), 'code', array(2, 3)),
            /* html 通过iframe的srcdoc属性实现的HTML内容嵌入（标记独占一行，高优先级）*/
            '!^(^|.*?\n+)\[html(=[^\]]*)?\](\n+.*?\n+)\[/html\](\n+.*|$)$!is' => array(array(1, 4), 'html', array(2, 3)),
            /* textbox 文本框（标记独占一行，高优先级）*/
            '!^(^|.*?\n+)\[text(?:=([^\]]*))?\](\n+.*?\n+)\[/text\](\n+.*|$)$!is' => array(array(1, 4), 'textbox', array(2, 3)),

            /* 4个空格或一个tab开头的markdown代码块 */
            '!^(^|.*?\n+)((?:\t|    )[^\n]*(?:\n+(?:\t|    )[^\n]*)*)(\n+.*|$)$!is' => array(array(1, 3), 'mdpre', array(2)),

            /*inline代码（优先级比上面的低）*/
            '!^(.*?)((`+).+?\3)(.*)$!is' => array(array(1, 4), 'mdpre', array(2)),
        ];

		$this->parse = $parseHead + $this->parse;
		
		return array(array(
          'type' => 'markdown',
		));
    }