Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Math.round(25*Math.random()))):/\s/.test(u)?n.push(" "):n.push("?"):n.push(g?"0":Math.round(9*Math.random()))}return n.join("")};EditorUi.prototype.anonymizePatch=function(d){if(null!=d[EditorUi.DIFF_INSERT])for(var g=0;g<d[EditorUi.DIFF_INSERT].length;g++)try{var n=mxUtils.parseXml(d[EditorUi.DIFF_INSERT][g].data).documentElement.cloneNode(!1);null!=n.getAttribute("name")&&n.setAttribute("name",this.anonymizeString(n.getAttribute("name")));d[EditorUi.DIFF_INSERT][g].data=mxUtils.getXml(n)}catch(v){d[EditorUi.DIFF_INSERT][g].data=
v.message}if(null!=d[EditorUi.DIFF_UPDATE]){for(var t in d[EditorUi.DIFF_UPDATE]){var u=d[EditorUi.DIFF_UPDATE][t];null!=u.name&&(u.name=this.anonymizeString(u.name));null!=u.cells&&(g=mxUtils.bind(this,function(v){var A=u.cells[v];if(null!=A){for(var H in A)null!=A[H].value&&(A[H].value="["+A[H].value.length+"]"),null!=A[H].xmlValue&&(A[H].xmlValue="["+A[H].xmlValue.length+"]"),null!=A[H].style&&(A[H].style="["+A[H].style.length+"]"),mxUtils.isEmptyObject(A[H])&&delete A[H];mxUtils.isEmptyObject(A)&&
delete u.cells[v]}}),g(EditorUi.DIFF_INSERT),g(EditorUi.DIFF_UPDATE),mxUtils.isEmptyObject(u.cells)&&delete u.cells);mxUtils.isEmptyObject(u)&&delete d[EditorUi.DIFF_UPDATE][t]}mxUtils.isEmptyObject(d[EditorUi.DIFF_UPDATE])&&delete d[EditorUi.DIFF_UPDATE]}return d};EditorUi.prototype.anonymizeAttributes=function(d,g){if(null!=d.attributes)for(var n=0;n<d.attributes.length;n++)"as"!=d.attributes[n].name&&d.setAttribute(d.attributes[n].name,this.anonymizeString(d.attributes[n].value,g));if(null!=d.childNodes)for(n=