Possible XSS vulnerability

[enferas]

Hello,

I would like to report for possible XSS vulnerability.

The path of the vulnerability in files https://github.com/lincanbin/Carbon-Forum/blob/master/library/PHPAnalysis.demo.php

// line 27
// the source
$str = (isset($_POST['source']) ? $_POST['source'] : '');

// line 59
$pa->SetSource($str);
//...
$pa->StartAnalysis( $do_fork );
$okresult = $pa->GetFinallyResult(' ', $do_prop);

// line 118
<textarea name="result" id="result" style="width:98%;height:120px;font-size:14px;color:#555"><?php echo (isset($okresult) ? $okresult : ''); ?></textarea>

In file https://github.com/lincanbin/Carbon-Forum/blob/master/library/PHPAnalysis.class.php

public function SetSource($source, $source_charset = 'utf-8', $target_charset = 'utf-8')
	{
		//...
				$this->sourceString = iconv('utf-8', UCS2, $source);
		//...
	}

public function StartAnalysis($optimize = true){
    //..
    $s = 0;
    //..
    for ($i = 0; $i < $slen; $i++) {
        $c  = $this->sourceString[$i] . $this->sourceString[++$i];
        $cn = hexdec(bin2hex($c));
        //...
        $s++;
        //...
        if ($cn == 0x3000) {
            continue;
        } else {
            $this->simpleResult[$s]['w'] = $c;
            $this->simpleResult[$s]['t'] = 5;
            $s++;
        }
    } 

    $this->_sort_finally_result();
}

private function _sort_finally_result()
	{
		$newarr = array();
		$i      = 0;
		foreach ($this->simpleResult as $k => $v) {
			//...
			} else if ($v['t'] != 21) {
				$newarr[$i]['w'] = $v['w'];
				$newarr[$i]['t'] = $v['t'];
				$i++;
			}
		}
		$this->finallyResult = $newarr;
		$newarr              = '';
	}

public function GetFinallyResult($spword = ' ', $word_meanings = false)
	{
		$rsstr = '';
		foreach ($this->finallyResult as $v) {
			if ($this->resultType == 2 && ($v['t'] == 3 || $v['t'] == 5)) {
				continue;
			}
			$m = '';
			if ($word_meanings) {
				$m = $this->GetWordProperty($v['w']);
			}
			$w = $this->_out_string_encoding($v['w']);
			if ($w != ' ') {
				if ($word_meanings) {
					$rsstr .= $spword . $w . $m;
				} else {
					$rsstr .= $spword . $w;
				}
			}
		}
		return $rsstr;
	}

So as we can see that the source $_POST['source'] will pass to the echo in line 118 in file PHPAnalysis.demo.php without being sanitized.