Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(Na){P=b.sidebar.currentElt==ra}),null,null),mxEvent.addListener(fa,"click",mxUtils.bind(this,function(Na){P||Ma(Na,null!=ma?ma:oa);mxEvent.consume(Na)})));da.appendChild(ra);return ra}function l(){function aa(ra,Fa){ra=mxResources.get(ra,null,ra.substring(0,1).toUpperCase()+ra.substring(1));18<ra.length&&(ra=ra.substring(0,18)+"&hellip;");return ra+(null!=Fa?" ("+Fa.length+")":"")}function la(ra,Fa,Ka){mxEvent.addListener(Fa,"click",function(){Ia!=Fa&&(Ia.style.backgroundColor=
"",Ia=Fa,Ia.style.backgroundColor=E,da.scrollTop=0,da.innerText="",K=0,null!=ua[ra].content?(da.appendChild(ua[ra].content),na=ba,Ha=null,null!=ua[ra].content.init&&ua[ra].content.init()):(Ha=Ka?va[ra][Ka]:ua[ra],U=null,t(!1)))});null!=urlParams["smart-template"]&&"smartTemplate"==ra&&Fa.click()}Ta&&(Ta=!1,mxEvent.addListener(da,"scroll",function(ra){da.scrollTop+da.clientHeight>=da.scrollHeight&&(t(),mxEvent.consume(ra))}));if(0<Da){var ma=document.createElement("div");ma.style.cssText="font-weight: bold;background: #f9f9f9;padding: 5px 0 5px 0;text-align: center;";