Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function __construct(GitRepository $repository, $url, array $hooklogs, CSRFSynchronizerToken $csrf)
    {
        $use_default_edit_modal = false;
        parent::__construct($repository, 'jenkins', $url, [], $csrf, $use_default_edit_modal);

        $this->remove_form_action = '/plugins/hudson_git/?group_id=' . (int) $repository->getProjectId();