Language: JavaScript
Label: vulnerable
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
        htmlConverter: sourceDocument.getURL('get', $.param({
          sheet: 'CKEditor.HTMLConverter',
          outputSyntax: 'plain',
          language: $('html').attr('lang') || ''
        }))
      }, editor.config['xwiki-source']);

      // The source command is not registered if the editor is loaded in-line.
      var sourceCommand = editor.getCommand('source');
      if (sourceCommand) {
        editor.on('beforeSetMode', this.onBeforeSetMode.bind(this));
        editor.on('beforeModeUnload', this.onBeforeModeUnload.bind(this));
        editor.on('mode', this.onMode.bind(this));

        // The default source command is not asynchronous so it becomes (re)enabled right after the editing mode is
        // changed. In our case switching between WYSIWYG and Source mode is asynchronous because we need to convert the
        // edited content on the server side. Thus we need to prevent the source command from being enabled while the
        // conversion takes place.
        // CKEDITOR-66: Switch to source corrupt page when connection lost or when connection is very slow
        var oldCheckAllowed = sourceCommand.checkAllowed;
        sourceCommand.checkAllowed = function() {
          return !this.running && oldCheckAllowed.apply(this, arguments);
        };
      }
    },