Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.length&&(208==c.charCodeAt(0)&&207==c.charCodeAt(1)&&17==c.charCodeAt(2)&&224==c.charCodeAt(3)&&161==c.charCodeAt(4)&&177==c.charCodeAt(5)&&26==c.charCodeAt(6)&&225==c.charCodeAt(7)||80==c.charCodeAt(0)&&75==c.charCodeAt(1)&&3==c.charCodeAt(2)&&4==c.charCodeAt(3)||80==c.charCodeAt(0)&&75==c.charCodeAt(1)&&3==c.charCodeAt(2)&&6==c.charCodeAt(3))};EditorUi.prototype.isRemoteVisioData=function(c){return 8<c.length&&(208==c.charCodeAt(0)&&207==c.charCodeAt(1)&&17==c.charCodeAt(2)&&224==c.charCodeAt(3)&&
161==c.charCodeAt(4)&&177==c.charCodeAt(5)&&26==c.charCodeAt(6)&&225==c.charCodeAt(7)||60==c.charCodeAt(0)&&63==c.charCodeAt(1)&&120==c.charCodeAt(2)&&109==c.charCodeAt(3)&&108==c.charCodeAt(3))};var b=EditorUi.prototype.createKeyHandler;EditorUi.prototype.createKeyHandler=function(c){var e=b.apply(this,arguments);if(!this.editor.chromeless||this.editor.editable){var g=e.getFunction,q=this.editor.graph,p=this;e.getFunction=function(t){if(q.isSelectionEmpty()&&null!=p.pages&&0<p.pages.length){var x=