Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.getHashObject=function(){var d=window.location.hash,f={};if(null!=d&&0<d.length){var k=d.lastIndexOf("#");if(0<k){d=decodeURIComponent(d.substring(k+1));try{f=JSON.parse(d)}catch(v){}}}return f};EditorUi.prototype.updateHashObject=function(){if(null!=this.currentFile&&""!=this.currentFile.getHash()&&null!=this.currentPage&&0<this.getSelectedPageIndex()){var d=this.getHashObject();d.pageId=this.currentPage.getId();this.setHashObject(d)}else this.setHashObject(null)};EditorUi.prototype.setHashObject=