Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
h.pages?h.pages.length:1;if(null!=h.pages){var T=function(Fa){Fa=Fa.getName();var ka=h.editor.graph,Za=null;null!=ka.themes&&"darkTheme"==ka.defaultThemeName&&(Za=ka.stylesheet,ka.stylesheet=ka.getDefaultStylesheet(),ka.refresh());try{var yb=m(ka);Q[Fa]=x(ka,yb);K(ka,Fa);I(P,ca+1);ha[Fa]=yb}finally{null!=Za&&(ka.stylesheet=Za,ka.refresh())}},V=h.editor.graph.getSelectionCells(),oa=h.currentPage;if(H)T(oa);else{for(var ca=0;ca<h.pages.length;ca++){var qa=h.pages[ca];h.currentPage!=qa&&h.selectPage(qa,