Language: Go
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
func (t *Teler) checkCommonWebAttack(r *http.Request) error {
	// Decode the URL-encoded request URI of the URL
	uri := toURLDecode(r.URL.RequestURI())

	// Declare byte slice for request body.
	var body string

	// Initialize buffer to hold request body.
	buf := &bytes.Buffer{}

	// Use io.Copy to copy the request body to the buffer.
	_, err := io.Copy(buf, r.Body)
	if err == nil {
		// If the read not fails, replace the request body
		// with a new io.ReadCloser that reads from the buffer.
		r.Body = io.NopCloser(buf)

		// Convert the buffer to a string.
		body = buf.String()
	}

	// Decode the URL-encoded of body
	body = toURLDecode(body)

	// Iterate over the filters in the CommonWebAttack data stored in the t.threat.cwa.Filters field
	for _, filter := range t.threat.cwa.Filters {
		// Initialize a variable to track whether a match is found
		var match bool

		// Check the type of the filter's pattern
		switch pattern := filter.pattern.(type) {
		case *regexp.Regexp: // If the pattern is a regex
			match = pattern.MatchString(uri) || pattern.MatchString(body)
		case *pcre.Matcher: // If the pattern is a PCRE expr
			match = pattern.MatchString(uri, 0) || pattern.MatchString(body, 0)
		default: // If the pattern is of an unknown type, skip to the next iteration
			continue
		}

		// If the pattern matches the request URI or body, return an error indicating a common web attack has been detected
		if match {
			return errors.New(filter.Description)
		}
	}

	// Return nil if no match is found
	return nil
}