Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
match.index+q.length}}N&&(t.push(e.substring(r)),C.setAttributeForCell(u,"label",t.join("")),C.setAttributeForCell(u,"placeholders","1"))}for(var aa in F)if(F.hasOwnProperty(aa)&&aa.toString().startsWith("ShapeData_"))try{var U=F[aa],wa=mxUtils.trim(U.Label).replace(/[^a-z0-9]+/ig,"_").replace(/^\d+/,"").replace(/_+$/,"");Za(u,wa,U.Value,C)}catch(ja){window.console&&console.log("Ignored "+aa+":",ja)}}function Za(u,F,C,t){for(var e=F,N=0;null!=t.getAttributeForCell(u,e);)N++,e=F+"_"+N;t.setAttributeForCell(u,
e,null!=C?C:"")}function yb(u,F,C,t,e,N){var r=g(F);if(null!=r){var q=Od[r.Class];null!=q?(u.style+=q,";"!=u.style.charAt(u.style.length-1)&&(u.style+=";")):u.edge||(console.log("No mapping found for: "+r.Class),LucidImporter.hasUnknownShapes=!0);q=null!=r.Properties?r.Properties:r;if(null!=q&&(u.value=N?"":m(q),u.style+=c(u.style,q,r,u,G,!0),u.style.includes("strokeColor")||(u.style+=K(q,r)),ka(u,q,C),q.Title&&q.Title.t&&q.Text&&q.Text.t&&"ExtShape"!=r.Class.substr(0,8)&&(C=u.geometry,C=new mxCell(m(q.Title),