Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var G=this.click;this.click=function(S){var U=null==S.state&&null!=S.sourceState&&this.isCellLocked(this.getLayerForCell(S.sourceState.cell));if(this.isEnabled()&&!U||S.isConsumed())return G.apply(this,arguments);U=U?S.sourceState.cell:S.getCell();null!=U&&(U=this.getClickableLinkForCell(U),null!=U&&(this.isCustomLink(U)?this.customLinkClicked(U):this.openLink(U)))};this.tooltipHandler.getStateForEvent=function(S){return S.sourceState};var ja=this.tooltipHandler.show;this.tooltipHandler.show=function(){ja.apply(this,
arguments);if(null!=this.div)for(var S=this.div.getElementsByTagName("a"),U=0;U<S.length;U++)null!=S[U].getAttribute("href")&&null==S[U].getAttribute("target")&&S[U].setAttribute("target","_blank")};this.tooltipHandler.getStateForEvent=function(S){return S.sourceState};this.getCursorForMouseEvent=function(S){var U=null==S.state&&null!=S.sourceState&&this.isCellLocked(S.sourceState.cell);return this.getCursorForCell(U?S.sourceState.cell:S.getCell())};var fa=this.getCursorForCell;this.getCursorForCell=