Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ma[Xa],0<ia.length&&(oa=document.createElement("div"),oa.className="geTempDlgImportCat",oa.innerText=mxResources.get(Xa,null,Xa),ea.appendChild(oa),A(ia,aa,la,null,!0))}function S(ia,aa){qa.innerText="";x();var la=Math.floor(qa.offsetWidth/150)-1;aa=!aa&&ia.length>la?la:ia.length;for(var ma=0;ma<aa;ma++){var oa=ia[ma];oa.isCategory=!0;var fa=document.createElement("div"),ja=mxResources.get(oa.title);null==ja&&(ja=oa.title.substring(0,1).toUpperCase()+oa.title.substring(1));fa.className="geTempDlgNewDiagramCatItem";
fa.setAttribute("title",ja);ja=mxUtils.htmlEntities(ja);15<ja.length&&(ja=ja.substring(0,15)+"&hellip;");null==P&&(I(!0),x(fa,"geTempDlgNewDiagramCatItemActive",oa));var sa=document.createElement("div");sa.className="geTempDlgNewDiagramCatItemImg";var ta=document.createElement("img");ta.src=NEW_DIAGRAM_CATS_PATH+"/"+oa.img;sa.appendChild(ta);fa.appendChild(sa);sa=document.createElement("div");sa.className="geTempDlgNewDiagramCatItemLbl";sa.innerHTML=ja;fa.appendChild(sa);qa.appendChild(fa);(function(La,
Ga){mxEvent.addListener(fa,"click",function(){P!=Ga&&(I(!0),x(Ga,"geTempDlgNewDiagramCatItemActive",La))});mxEvent.addListener(fa,"dblclick",B)})(oa,fa)}fa=document.createElement("div");fa.className="geTempDlgNewDiagramCatItem";ja=mxResources.get("showAllTemps");fa.setAttribute("title",ja);sa=document.createElement("div");sa.className="geTempDlgNewDiagramCatItemImg";sa.innerText="...";sa.style.fontSize="32px";fa.appendChild(sa);sa=document.createElement("div");sa.className="geTempDlgNewDiagramCatItemLbl";
sa.innerText=ja;fa.appendChild(sa);qa.appendChild(fa);mxEvent.addListener(fa,"click",function(){function La(){var ya=Ga.querySelector(".geTemplateDrawioCatLink");null!=ya?ya.click():setTimeout(La,200)}ha=!0;var Ga=O.querySelector(".geTemplatesList");Ga.style.display="block";Ba.style.width="";xa.style.display="";xa.value="";Z=null;La()});na.style.display=ia.length<=la?"none":""}function l(ia,aa,la){function ma(Ka,Xa){Ka=mxResources.get(Ka,null,Ka.substring(0,1).toUpperCase()+Ka.substring(1));var Pa=