Language: Java
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public TestFreeMarkerView(String template) throws Exception {
        FreeMarkerConfigurer configurer = new FreeMarkerConfigurer();
        configurer.setDefaultEncoding(StandardCharsets.UTF_8.name());
        configurer.setTemplateLoaderPath("file:src/main/webapp/WEB-INF/vm");

        Properties settings = new Properties();
        settings.put("recognizeStandardFileExtensions", "true");
        configurer.setFreemarkerSettings(settings);

        setConfiguration(configurer.createConfiguration());
        setServletContext(new MockServletContext());
        setRequestContextAttribute(REQUEST_CONTEXT_ATTRIBUTE);
        setUrl(template);
    }