Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
W){var ba=Q.getGlobalVariable;Q=this.createTemporaryGraph(Q.getStylesheet());for(var da,qa=0;qa<this.pages.length;qa++)if(this.pages[qa].getId()==W){da=this.updatePageRoot(this.pages[qa]);break}null==da&&(da=this.currentPage);Q.getGlobalVariable=function(wa){return"page"==wa?da.getName():"pagenumber"==wa?1:ba.apply(this,arguments)};document.body.appendChild(Q.container);Q.model.setRoot(da.root)}if(null!=A.layerIds){var ka=Q.model,Aa=ka.getChildCells(ka.getRoot()),xa={};for(qa=0;qa<A.layerIds.length;qa++)xa[A.layerIds[qa]]=