Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
S(la.url,la.libs,la.title,la.tooltip?la.tooltip:la.title,la.select,la.imgUrl,la.info,la.onClick,la.preview,la.noImg,la.clibs);aa&&la.click();aa=!1}}function x(aa,la,ma,oa,fa,ja){if(null!=aa&&mxUtils.isAncestorNode(document.body,oa)){aa=mxUtils.parseXml(aa);aa=Editor.parseDiagramNode(aa.documentElement);var sa=new mxCodec(aa.ownerDocument),ta=new mxGraphModel;sa.decode(aa,ta);aa=ta.root.getChildAt(0).children;b.sidebar.createTooltip(oa,aa,Math.min((window.innerWidth||document.documentElement.clientWidth||
document.body.clientWidth)-80,1E3),Math.min((window.innerHeight||document.documentElement.clientHeight||document.body.clientHeight)-80,800),null!=fa?mxResources.get(fa):null,!0,new mxPoint(la,ma),!0,function(){P=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display;null!=ja&&A(oa,null,null,ja,infoObj,clibs)},!0,!1)}}function B(){var aa=document.createElement("div");aa.style.position="absolute";aa.style.overflow="visible";aa.style.left="8px";aa.style.right="8px";aa.style.bottom="8px";aa.style.top=