Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0;ja<ta.length;ja++)oa=ta[ja],0==fa==(null==la[oa.url])&&(Ga[oa.url]=!0,La.push(oa));la=Ga;fa++}0==La.length?za.innerText=mxResources.get("noResultsFor",[ia]):A(La,!0)}}function D(ia){if(Z!=ia||T!=ca)q(),Ba.scrollTop=0,ea.innerText="",za.innerText=mxResources.get("searchResults")+' "'+ia+'"',Ua=null,ha?C(ia):F&&(ia?(Qa.spin(ea),k=!1,V=!0,F(ia,Va,function(){g(mxResources.get("searchFailed"));Va([])},T?null:v)):z(T)),Z=ia,ca=T}function M(ia){null!=Ua&&clearTimeout(Ua);13==ia.keyCode?D(xa.value):Ua=