Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
BmpDecoder.prototype.bit1=function(){for(var h=Math.ceil(this.width/8),y=h%4,A=this.height-1;0<=A;A--){for(var B=0;B<h;B++)for(var m=this.buffer[this.pos++],g=A*this.width*4+32*B,b=0;8>b;b++)if(8*B+b<this.width){var a=this.palette[m>>7-b&1];this.data[g+4*b]=a.red;this.data[g+4*b+1]=a.green;this.data[g+4*b+2]=a.blue;this.data[g+4*b+3]=255}else break;0!=y&&(this.pos+=4-y)}};