Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
""}if("Liberation Sans"!=u)return lb="fontFamily="+u+";","font-family: "+u+";"}}catch(t){}return""}function A(u){return Math.round(10*u)/10}function B(u,F,C){function t(la,Ma){var ya="",za=la.t,Qb=la.l||{v:za&&"ul"==za.v?"auto":"decimal"};if(null==za||0!=Na&&Na==za.v&&Ka==Qb.v)null==za&&(Na&&(ya+=N(!0),Na=!1),ya+='<div style="',Ca.push("div"));else{Na&&(ya+=N(!0));Na=za.v;Ka=Qb.v;"ul"==za.v?(ya+="<ul ",Ca.push("ul")):(ya+="<ol ",Ca.push("ol"));ya+='style="margin: 0px; padding-left: 10px;list-style-position: inside; list-style-type:';