Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.appendChild(d.resizeSensor);"static"==q(d,"position")&&(d.style.position="relative");var l=d.resizeSensor.childNodes[0],u=l.childNodes[0],A=d.resizeSensor.childNodes[1],B=function(){u.style.width="100000px";u.style.height="100000px";l.scrollLeft=1E5;l.scrollTop=1E5;A.scrollLeft=1E5;A.scrollTop=1E5};B();var F=!1,M=function(){d.resizedAttached&&(F&&(d.resizedAttached.call(),F=!1),b(M))};b(M);var O,H,ja,da;f=function(){if((ja=d.offsetWidth)!=O||(da=d.offsetHeight)!=H)F=!0,O=ja,H=da;B()};var ca=function(ia,
ma,aa){ia.attachEvent?ia.attachEvent("on"+ma,aa):ia.addEventListener(ma,aa)};ca(l,"scroll",f);ca(A,"scroll",f)}var K=function(){GraphViewer.resizeSensorEnabled&&n()};if(GraphViewer.useResizeObserver&&"undefined"!==typeof ResizeObserver){var S=null,G=!1;(new ResizeObserver(function(){G||(null!=S&&window.clearTimeout(S),S=window.setTimeout(function(){G=!0;K();S=null;G=!1},200))})).observe(g)}else{var L=Object.prototype.toString.call(g),R="[object Array]"===L||"[object NodeList]"===L||"[object HTMLCollection]"===