Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.debug("[Performance] EditorUi.clonePages",[this],"time",Date.now()-f+" ms","args",arguments);return u});null!=G?(d.getHashValueForPages=G,G=null):(G=d.getHashValueForPages,d.getHashValueForPages=function(){var f=Date.now(),u=G.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.getHashValueForPages",[this],"time",Date.now()-f+" ms","args",arguments);return u});null!=C?(d.resolveCrossReferences=C,C=null):(C=d.resolveCrossReferences,d.resolveCrossReferences=function(){var f=Date.now(),
u=C.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.resolveCrossReferences",[this],"time",Date.now()-f+" ms","args",arguments);return u});EditorUi.debug("[Performance]",null!=p?"Enabled":"Disabled")}));this.put("testDevelop",new Menu(mxUtils.bind(this,function(f,u){this.addMenuItems(f,"createSidebarEntry showBoundingBox - testCheckPages testChecksum testFixPages - testCheckFile testDiff - testInspect testOptimize - testXmlImageExport -".split(" "),u);var D=f.addItem(mxResources.get("testPerformance"),