Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function Room_view(Room $room, ShiftsFilterRenderer $shiftsFilterRenderer, ShiftCalendarRenderer $shiftCalendarRenderer)
{
    $user = auth()->user();

    $assignNotice = '';
    if (config('signup_requires_arrival') && !$user->state->arrived) {
        $assignNotice = info(render_user_arrived_hint(), true);
    }

    $description = '';
    if ($room->description) {
        $description = '<h3>' . __('Description') . '</h3>';
        $parsedown = new Parsedown();
        $description .= $parsedown->parse($room->description);
    }

    $dect = '';
    if (config('enable_dect') && $room->dect) {
        $dect = heading(__('Contact'), 3)
            . description([__('DECT') => sprintf('<a href="tel:%s">%1$s</a>', $room->dect)]);
    }

    $tabs = [];
    if ($room->map_url) {
        $tabs[__('Map')] = sprintf(
            '<div class="map">'
            . '<iframe style="width: 100%%; min-height: 400px; border: 0 none;" src="%s"></iframe>'
            . '</div>',
            $room->map_url
        );
    }

    $tabs[__('Shifts')] = div('first', [
        $shiftsFilterRenderer->render(page_link_to('rooms', [
            'action'  => 'view',
            'room_id' => $room->id,
        ]), ['rooms' => [$room->id]]),
        $shiftCalendarRenderer->render(),
    ]);

    $selected_tab = 0;
    $request = request();
    if ($request->has('shifts_filter_day')) {
        $selected_tab = count($tabs) - 1;
    }

    return page_with_title(icon('pin-map-fill') . $room->name, [
        $assignNotice,
        auth()->can('admin_rooms') ? buttons([
            button(
                page_link_to('admin/rooms/edit/' . $room->id),
                icon('pencil') . __('edit')
            ),
        ]) : '',
        $dect,
        $description,
        tabs($tabs, $selected_tab),
    ], true);
}