Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
La+" ("+Xa.length+")",Ta=La=mxUtils.htmlEntities(La);15<La.length&&(La=La.substring(0,15)+"&hellip;");return{lbl:La+" ("+Xa.length+")",fullLbl:Sa,lblOnly:Ta}}function pa(La,Xa,Sa,Ta,Pa){mxEvent.addListener(Sa,"click",function(){B!=Sa&&(null!=B?(B.style.fontWeight="normal",B.style.textDecoration="none"):(fa.style.display="none",ba.style.minHeight="100%"),B=Sa,B.style.fontWeight="bold",B.style.textDecoration="underline",Ca.scrollTop=0,T&&(m=!0),za.innerHTML=Xa,Ba.style.display="none",F(Pa?aa[La]:Ta?
Da[La][Ta]:ja[La],Pa?!1:!0))})}var ha=N.querySelector(".geTemplatesList");if(0<la){la=document.createElement("div");la.style.cssText="font-weight: bold;background: #f9f9f9;padding: 5px 0 5px 0;text-align: center;margin-top: 10px;";mxUtils.write(la,mxResources.get("custom"));ha.appendChild(la);for(var ka in aa){la=document.createElement("div");var ua=aa[ka];ua=na(ka,ua);la.className="geTemplateCatLink";la.setAttribute("title",ua.fullLbl);la.innerHTML=ua.lbl;ha.appendChild(la);pa(ka,ua.lblOnly,la,null,