Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function renderPage($module, $scope)
    {
        $this->view->pick('OPNsense/Diagnostics/log');
        $this->view->module = $module;
        $this->view->scope = $scope;
        $this->view->service = '';
        $this->view->default_log_severity = 'Warning';

        $service = $module == 'core' ? $scope : $module;

        /* XXX manually hook up known services and log severities for now */
        switch ($service) {
            case 'filter':
                $this->view->default_log_severity = 'Informational';
                break;
            case 'ipsec':
                $this->view->service = 'ipsec';
                break;
            case 'resolver':
                $this->view->service = 'unbound';
                break;
            case 'suricata':
                $this->view->service = 'ids';
                break;
            case 'squid':
                $this->view->service = 'proxy';
                break;
            case 'system':
                $this->view->default_log_severity = 'Notice';
                break;
            default:
                /* no service API at the moment */
                break;
        }
    }