Language: TypeScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function pointInPolygon(testx, testy, polygon) {
    let intersections = 0;

    for (let i = 0, j = polygon.length - 1; i < polygon.length; j = i++) {
        const [prevX, prevY] = polygon[j];
        const [x, y] = polygon[i];

        // count intersections
        if (((y > testy) != (prevY > testy)) && (testx < (prevX - x) * (testy - y) / (prevY - y) + x)) {
            intersections++;
        }
    }

    // point is in polygon if intersection count is odd
    return intersections & 1;
}