Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function doExportString() {
    getData();
    let exportArray = [];
    for (let i = 0; i < entries.length; i++) {
        let entry = entries[i];
        let arrayForEntry = [];
        arrayForEntry[0] = entry.name;
        arrayForEntry[1] = entry.firstName;
        arrayForEntry[2] = dateToStandard(entry.birthdate);
        arrayForEntry[3] = entry.sex;
        arrayForEntry[4] = entry.zip;
        arrayForEntry[5] = entry.residency;
        arrayForEntry[6] = entry.nationality;
        arrayForEntry[7] = entry.street;
        arrayForEntry[8] = entry.identityDisk;
        arrayForEntry[9] = entry.district;
        arrayForEntry[10] = entry.rcUnit;
        arrayForEntry[11] = entry.place;
        arrayForEntry[12] = entry.unit;
        arrayForEntry[13] = dateToStandard(entry.start, true);
        let entryString = "";
        for (let j = 0; j < entryLength - 1; j++) {
            if (arrayForEntry[j] != undefined) entryString += arrayForEntry[j] + ";";
            else entryString += ";";
        }
        exportArray.push(entryString);
    }
    let newExportString = "";
    for (let j = 0; j < exportArray.length; j++) {
        newExportString += exportArray[j] + "\n";
    }
    exportString = newExportString;
    document.getElementById("export-overlay").style.display = "inline";
}