Language: TypeScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
const parseContent = (id, source, children, parse) => {
  let result;
  let setInnerHTML = false;

  if (!children || children.length === 0 || children instanceof Function) {
    const template = source.querySelector(`template#${id}`);
    const templateHTML = template.innerHTML ?? "";

    if (parse) {
      const parsed = parseHTML(templateHTML);
      const childResult = children instanceof Function ? children(parsed) : false;

      result = childResult || parsed;
    } else {
      const childResult = children instanceof Function ? children(template) : false;

      if (childResult) {
        result = childResult;
      } else {
        result = templateHTML;
        setInnerHTML = true;
      }
    }
  } else {
    result = children;
  }

  return { children: result, setInnerHTML };
};