Language: Java
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    private String generateTooltipHtml(CmsListInfoBean infoBean) {

        Element root = DOM.createElement("div");
        appendDom(appendDom(root, "p"), "b").setInnerText(CmsClientStringUtil.shortenString(infoBean.getTitle(), 70));
        if (infoBean.hasAdditionalInfo()) {
            for (CmsAdditionalInfoBean additionalInfo : infoBean.getAdditionalInfo()) {
                appendDom(root, "p").setInnerText(
                    additionalInfo.getName()
                        + ":\u00a0"
                        + CmsClientStringUtil.shortenString(additionalInfo.getValue(), 45));
            }
        }
        return root.getInnerHTML();
    }