Language: TypeScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function TuleapHighlightFilter() {
    function isTextSearchable(text, search) {
        return text && (search || isNumber(search));
    }

    return function (text, search) {
        if (!isTextSearchable(text, search)) {
            return text ? text.toString() : text;
        }

        const classifier = Classifier(String(search));
        const parts = classifier.classify(String(text)).map((highlighted_text) => {
            if (!HighlightedText.isHighlight(highlighted_text)) {
                return highlighted_text.content;
            }
            return `<span class="highlight">${highlighted_text.content}</span>`;
        });
        return parts.join("");
    };
}