Language: JavaScript
Label: vulnerable
CWE: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Code:
		setEditor: function(html, strip)
		{

			if (strip !== false)
			{
				html = this.cleanSavePreCode(html);

				html = this.cleanStripTags(html);
				html = this.cleanConvertProtected(html);
				html = this.cleanConvertInlineTags(html, true);

				if (this.opts.linebreaks === false)	html = this.cleanConverters(html);
				else html = html.replace(/<p(.*?)>([\w\W]*?)<\/p>/gi, '$2<br>');
			}

			html = html.replace(/&amp;#36;/g, '$');

			html = this.cleanEmpty(html);
			html = this.sanitizeHTML(html);

			this.$editor.html(html);

			this.setNonEditable();
			this.setSpansVerified();

			this.sync();
		},