Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(Oa){R=b.sidebar.currentElt==ra}),null,null),mxEvent.addListener(ha,"click",mxUtils.bind(this,function(Oa){R||Na(Oa,null!=na?na:pa);mxEvent.consume(Oa)})));fa.appendChild(ra);return ra}function p(){function aa(ra,Ha){ra=mxResources.get(ra,null,ra.substring(0,1).toUpperCase()+ra.substring(1));18<ra.length&&(ra=ra.substring(0,18)+"&hellip;");return ra+(null!=Ha?" ("+Ha.length+")":"")}function la(ra,Ha,La){mxEvent.addListener(Ha,"click",function(){Fa!=Ha&&(Fa.style.backgroundColor=
"",Fa=Ha,Fa.style.backgroundColor=x,fa.scrollTop=0,fa.innerText="",O=0,null!=sa[ra].content?(fa.appendChild(sa[ra].content),ma=ba,Ga=null,null!=sa[ra].content.init&&sa[ra].content.init()):(Ga=La?va[ra][La]:sa[ra],W=null,v(!1)))});null!=urlParams["smart-template"]&&"smartTemplate"==ra&&Ha.click()}Qa&&(Qa=!1,mxEvent.addListener(fa,"scroll",function(ra){fa.scrollTop+fa.clientHeight>=fa.scrollHeight&&(v(),mxEvent.consume(ra))}));if(0<Da){var na=document.createElement("div");na.style.cssText="font-weight: bold;background: #f9f9f9;padding: 5px 0 5px 0;text-align: center;";