Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K.setAttribute("FromSheet",B(T.id)),K.setAttribute("FromCell","EndX"),K.setAttribute("ToSheet",B(T.target.id)),H.appendChild(K)));P.appendChild(Q);O.restore();return P}function z(H,K,P,Q){H.file(K,(Q?"":'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>')+mxUtils.getXml(P,"\n"))}function E(H,K,P,Q){var R=mxUtils.createXmlDocument(),ha=mxUtils.createXmlDocument(),X=A(R,J.XMLNS,"Pages");X.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns",J.XMLNS);X.setAttributeNS("http://www.w3.org/2000/xmlns/",