Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public static function redirect(
        $url
    ) {
        /*
         * If the headers have been sent, then we cannot send an additional location header
         * so we will output a javascript redirect statement.
         */
        
        if (!empty($_REQUEST['ajax_load'])) {
            ob_get_clean();
            $ajax_ret = array(
                'content' => "<script>SUGAR.ajaxUI.loadContent('$url');</script>\n",
                'menu' => array(
                    'module' => $_REQUEST['module'],
                    'label' => translate($_REQUEST['module']),
                ),
            );
            $json = getJSONobj();
            echo $json->encode($ajax_ret);
        } else {
            if (headers_sent()) {
                echo "<script>SUGAR.ajaxUI.loadContent('$url');</script>\n";
            } else {
                //@ob_end_clean(); // clear output buffer
                session_write_close();
                header('HTTP/1.1 301 Moved Permanently');
                header("Location: " . $url);
            }
        }
        if (!defined('SUITE_PHPUNIT_RUNNER')) {
            exit();
        }
    }