Language: Go
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
func (req *UpdateInfoRequest) Check() (errFields []*validator.FormErrorField, err error) {
	if len(req.Username) > 0 {
		if checker.IsInvalidUsername(req.Username) {
			errField := &validator.FormErrorField{
				ErrorField: "username",
				ErrorMsg:   reason.UsernameInvalid,
			}
			errFields = append(errFields, errField)
			return errFields, errors.BadRequest(reason.UsernameInvalid)
		}
	}
	req.BioHTML = converter.Markdown2HTML(req.Bio)
	return nil, nil
}