Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
preview:aa.getAttribute("preview"),clibs:ha,tags:aa.getAttribute("tags")};ka.push(ha);null!=na&&(ka=va[pa],null==ka&&(ka={},va[pa]=ka),pa=ka[na],null==pa&&(pa=[],ka[na]=pa),pa.push(ha))}aa=aa.nextSibling}N.stop();p()}})};C.appendChild(qa);C.appendChild(ta);C.appendChild(fa);var Ua=!1,ja=z;/^https?:\/\//.test(ja)&&!b.editor.isCorsEnabledForUrl(ja)&&(ja=PROXY_URL+"?url="+encodeURIComponent(ja));N.spin(fa);null!=t?t(function(aa,la){Ea=aa;V=Da=la;Va()},Va):Va();Q=sa}mxEvent.addListener(P,"keypress",function(aa){b.dialog.container.firstChild==