Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(null==ma&&(fa=oa.indexOf("/"),ma=oa.substring(0,fa),null==la)){var ja=oa.indexOf("/",fa+1);-1<ja&&(la=oa.substring(fa+1,ja))}fa=Ea[ma];null==fa&&(Sa++,fa=[],Ea[ma]=fa);oa=ia.getAttribute("clibs");null!=aa[oa]&&(oa=aa[oa]);oa={url:ia.getAttribute("url"),libs:ia.getAttribute("libs"),title:ia.getAttribute("title")||ia.getAttribute("name"),preview:ia.getAttribute("preview"),clibs:oa,tags:ia.getAttribute("tags")};fa.push(oa);null!=la&&(fa=Da[ma],null==fa&&(fa={},Da[ma]=fa),ma=fa[la],null==ma&&(ma=[],
fa[la]=ma),ma.push(oa))}ia=ia.nextSibling}l(Ea,Ta,Ha)}})}function z(ia){E&&(Ba.scrollTop=0,ea.innerText="",Qa.spin(ea),k=!1,V=!0,za.innerText=mxResources.get("recentDiag"),Z=null,E(Va,function(){g(mxResources.get("cannotLoad"));Va([])},ia?null:v))}function C(ia){if(""==ia)null!=G&&(G.click(),G=null);else{if(null==TemplatesDialog.tagsList[d]){var aa={};for(La in Ea)for(var la=Ea[La],ma=0;ma<la.length;ma++){var oa=la[ma];if(null!=oa.tags)for(var fa=oa.tags.toLowerCase().split(";"),ja=0;ja<fa.length;ja++)null==