Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
InfographicsBlock:"mxCompositeShape",FlexiblePolygonBlock:"mxCompositeShape",PersonRoleBlock:"mxCompositeShape"},xf=RegExp("{{(date{.*}|[^%^{^}]+)}}","g");Qd.prototype.getSize=function(){return(this.nurbsValues.length/4|0)-1};Qd.prototype.getX=function(u){return Math.round(100*this.nurbsValues[4*(u+1)])/100};Qd.prototype.getY=function(u){return Math.round(100*this.nurbsValues[4*(u+1)+1])/100};LucidImporter.importState=function(u,F,C){function t(q){null!=q.state&&EditorUi.debug("convertLucidChart addPages",
q);if(q.Properties){for(var Z in q.Properties)"Stencil-"==Z.substr(0,8)&&Ke(Z.substr(8),q.Properties[Z]);LucidImporter.globalProps=q.Properties}for(var aa in q.Pages)Z=q.Pages[aa],Z.id=aa,Z.Data=q.Data,e.push(Z);e.sort(function(U,wa){return U.Properties.Order<wa.Properties.Order?-1:U.Properties.Order>wa.Properties.Order?1:0});for(q=0;q<e.length;q++)LucidImporter.pageIdsMap[e[q].id]=q}xc=wc=0;LucidImporter.stencilsMap={};LucidImporter.imgSrcRepl=F;LucidImporter.advImpConfig=C;LucidImporter.globalProps=