Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function resizeImage($source_file, $size){

        $dest_dir  = $this->getUploadDestinationDirectory();
        $dest_ext  = pathinfo($source_file, PATHINFO_EXTENSION);
        $dest_name = $this->getFileName($dest_dir, $dest_ext);

        $dest_file = $dest_dir . $dest_name;

        if (!isset($size['height'])) { $size['height'] = 0; }
        if (!isset($size['quality'])) { $size['quality'] = 90; }

        if (img_resize($source_file, $dest_file, $size['width'], $size['height'], $size['is_square'], $size['quality'])) {

            return str_replace($this->site_cfg->upload_path, '', $dest_file);

        }

        return false;

    }