Language: TypeScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
  decryptTopicPage(data) {
    if (!data.currentRouteName?.startsWith("topic.")) {
      return;
    }

    if (
      !this.container ||
      this.container.isDestroyed ||
      this.container.isDestroying
    ) {
      return;
    }

    const topicController = this.container.lookup("controller:topic");
    const topic = topicController.get("model");
    const topicId = topic.id;

    if (topic?.encrypted_title) {
      document.querySelector(".private_message").classList.add("encrypted");
    }

    getTopicTitle(topicId).then((topicTitle) => {
      // Update fancy title stored in model
      topicController.model.set("fancy_title", topicTitle);

      // Update document title
      const documentTitle = this.container.lookup("service:document-title");
      documentTitle.setTitle(
        documentTitle
          .getTitle()
          .replace(topicController.model.title, topicTitle)
      );
    });
  },