Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    private function wash_uri($uri, $blocked_source = false, $is_image = true)
    {
        if (!empty($this->config['cid_map'][$uri])) {
            return $this->config['cid_map'][$uri];
        }

        $key = $this->config['base_url'] . $uri;
        if (!empty($this->config['cid_map'][$key])) {
            return $this->config['cid_map'][$key];
        }

        // allow url(#id) used in SVG
        if (isset($uri[0]) && $uri[0] == '#') {
            if ($this->_css_prefix !== null) {
                $uri = '#' . $this->_css_prefix . substr($uri, 1);
            }

            return $uri;
        }

        if (preg_match('/^(http|https|ftp):.+/i', $uri)) {
            if (!empty($this->config['allow_remote'])) {
                return $uri;
            }

            $this->extlinks = true;
            if ($is_image && !empty($this->config['blocked_src'])) {
                return $this->config['blocked_src'];
            }
        }
        else if ($is_image && preg_match('/^data:image\/([^,]+),(.+)$/is', $uri, $matches)) { // RFC2397
            // svg images can be insecure, we'll sanitize them
            if (stripos($matches[1], 'svg') !== false) {
                $svg = $matches[2];

                if (stripos($matches[1], ';base64') !== false) {
                    $svg  = base64_decode($svg);
                    $type = $matches[1];
                }
                else {
                    $type = $matches[1] . ';base64';
                }

                $washer = new self($this->config);
                $svg    = $washer->wash($svg);

                // Invalid svg content
                if (empty($svg)) {
                    return null;
                }

                return 'data:image/' . $type . ',' . base64_encode($svg);
            }

            return $uri;
        }
    }