Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.parseHeader=function(){var h=this.buffer;this.fileSize=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.reserved=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.offset=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.headerSize=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.width=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];
this.pos+=4;this.height=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.planes=h[this.pos+1]<<8|h[this.pos];this.pos+=2;this.bitPP=h[this.pos+1]<<8|h[this.pos];this.pos+=2;this.compress=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.rawSize=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.hr=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.vr=h[this.pos+3]<<24|h[this.pos+
2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.colors=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;this.importantColors=h[this.pos+3]<<24|h[this.pos+2]<<16|h[this.pos+1]<<8|h[this.pos];this.pos+=4;16===this.bitPP&&this.is_with_alpha&&(this.bitPP=15);if(15>this.bitPP){h=0===this.colors?1<<this.bitPP:this.colors;this.palette=Array(h);for(var y=0;y<h;y++){var A=this.buffer[this.pos++],B=this.buffer[this.pos++],m=this.buffer[this.pos++],g=this.buffer[this.pos++];
this.palette[y]={red:m,green:B,blue:A,quad:g}}}};BmpDecoder.prototype.parseBGR=function(){this.pos=this.offset;try{var h="bit"+this.bitPP,y=document.createElement("canvas").getContext("2d").createImageData(this.width,this.height);this.imageData=y;this.data=y.data;this[h]()}catch(A){console.log("bit decode error:"+A)}};