Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function render(Shift $shift, $needed_angeltypes, $shift_entries, $user)
    {
        $info_text = '';
        if ($shift->title != '') {
            $info_text = icon('info-circle') . $shift->title . '<br>';
        }
        list($shift_signup_state, $shifts_row) = $this->renderShiftNeededAngeltypes(
            $shift,
            $needed_angeltypes,
            $shift_entries,
            $user
        );

        $class = $this->classForSignupState($shift_signup_state);

        $blocks = ceil(($shift->end->timestamp - $shift->start->timestamp) / ShiftCalendarRenderer::SECONDS_PER_ROW);
        $blocks = max(1, $blocks);

        $room = $shift->room;

        return [
            $blocks,
            div(
                'shift-card" style="height: '
                . ($blocks * ShiftCalendarRenderer::BLOCK_HEIGHT - ShiftCalendarRenderer::MARGIN)
                . 'px;',
                div(
                    'shift card bg-' . $class,
                    [
                        $this->renderShiftHead($shift, $class, $shift_signup_state->getFreeEntries()),
                        div('card-body ' . $this->classBg(), [
                            $info_text,
                            Room_name_render($room),
                        ]),
                        $shifts_row,
                    ]
                )
            ),