Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
S(la.url,la.libs,la.title,la.tooltip?la.tooltip:la.title,la.select,la.imgUrl,la.info,la.onClick,la.preview,la.noImg,la.clibs);aa&&la.click();aa=!1}}function A(aa,la,na,pa,ha,ka){if(null!=aa&&mxUtils.isAncestorNode(document.body,pa)){aa=mxUtils.parseXml(aa);aa=Editor.parseDiagramNode(aa.documentElement);var ua=new mxCodec(aa.ownerDocument),wa=new mxGraphModel;ua.decode(aa,wa);aa=wa.root.getChildAt(0).children;b.sidebar.createTooltip(pa,aa,Math.min((window.innerWidth||document.documentElement.clientWidth||
document.body.clientWidth)-80,1E3),Math.min((window.innerHeight||document.documentElement.clientHeight||document.body.clientHeight)-80,800),null!=ha?mxResources.get(ha):null,!0,new mxPoint(la,na),!0,function(){R=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display;null!=ka&&F(pa,null,null,ka,infoObj,clibs)},!0,!1)}}function H(){var aa=document.createElement("div");aa.style.position="absolute";aa.style.overflow="visible";aa.style.left="8px";aa.style.right="8px";aa.style.bottom="8px";aa.style.top=