Language: Go
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
func Satitize(data *imagedata.ImageData) (*imagedata.ImageData, error) {
	r := bytes.NewReader(data.Data)
	l := xml.NewLexer(parse.NewInput(r))

	buf, cancel := imagedata.BorrowBuffer()

	ignoreTag := 0

	for {
		tt, tdata := l.Next()

		if ignoreTag > 0 {
			switch tt {
			case xml.ErrorToken:
				cancel()
				return nil, l.Err()
			case xml.EndTagToken, xml.StartTagCloseVoidToken:
				ignoreTag--
			case xml.StartTagToken:
				ignoreTag++
			}

			continue
		}

		switch tt {
		case xml.ErrorToken:
			if l.Err() != io.EOF {
				cancel()
				return nil, l.Err()
			}

			newData := imagedata.ImageData{
				Data: buf.Bytes(),
				Type: data.Type,
			}
			newData.SetCancel(cancel)

			return &newData, nil
		case xml.StartTagToken:
			if strings.ToLower(string(l.Text())) == "script" {
				ignoreTag++
				continue
			}
			buf.Write(tdata)
		case xml.AttributeToken:
			if _, unsafe := unsafeAttrs[strings.ToLower(string(l.Text()))]; unsafe {
				continue
			}
			buf.Write(tdata)
		default:
			buf.Write(tdata)
		}
	}
}