Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(Na){P=b.sidebar.currentElt==ra}),null,null),mxEvent.addListener(fa,"click",mxUtils.bind(this,function(Na){P||Ma(Na,null!=ma?ma:oa);mxEvent.consume(Na)})));da.appendChild(ra);return ra}function l(){function aa(ra,Fa){ra=mxResources.get(ra,null,ra.substring(0,1).toUpperCase()+ra.substring(1));18<ra.length&&(ra=ra.substring(0,18)+"&hellip;");return ra+(null!=Fa?" ("+Fa.length+")":"")}function la(ra,Fa,Ka){mxEvent.addListener(Fa,"click",function(){Ia!=Fa&&(Ia.style.backgroundColor=