Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
preview:aa.getAttribute("preview"),clibs:fa,tags:aa.getAttribute("tags")};ja.push(fa);null!=ma&&(ja=va[oa],null==ja&&(ja={},va[oa]=ja),oa=ja[ma],null==oa&&(oa=[],ja[ma]=oa),oa.push(fa))}aa=aa.nextSibling}O.stop();l()}})};z.appendChild(qa);z.appendChild(wa);z.appendChild(da);var Ua=!1,ia=H;/^https?:\/\//.test(ia)&&!b.editor.isCorsEnabledForUrl(ia)&&(ia=PROXY_URL+"?url="+encodeURIComponent(ia));O.spin(da);null!=q?q(function(aa,la){Ea=aa;W=Da=la;Va()},Va):Va();T=ua}mxEvent.addListener(M,"keypress",function(aa){b.dialog.container.firstChild==