Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ha[la]=na),na.push(pa))}ja=ja.nextSibling}p(Ea,Qa,Ga)}})}function C(ja){x&&(Ca.scrollTop=0,ea.innerText="",Ka.spin(ea),m=!1,T=!0,za.innerText=mxResources.get("recentDiag"),Z=null,x(Va,function(){n(mxResources.get("cannotLoad"));Va([])},ja?null:l))}function J(ja){if(""==ja)null!=K&&(K.click(),K=null);else{if(null==TemplatesDialog.tagsList[c]){var aa={};for(Ma in Ea)for(var la=Ea[Ma],na=0;na<la.length;na++){var pa=la[na];if(null!=pa.tags)for(var ha=pa.tags.toLowerCase().split(";"),ka=0;ka<ha.length;ka++)null==
aa[ha[ka]]&&(aa[ha[ka]]=[]),aa[ha[ka]].push(pa)}TemplatesDialog.tagsList[c]=aa}var ua=ja.toLowerCase().split(" ");aa=TemplatesDialog.tagsList[c];if(0<Ga&&null==aa.__tagsList__){for(Ma in Qa)for(la=Qa[Ma],na=0;na<la.length;na++)for(pa=la[na],ha=pa.title.split(" "),ha.push(Ma),ka=0;ka<ha.length;ka++){var wa=ha[ka].toLowerCase();null==aa[wa]&&(aa[wa]=[]);aa[wa].push(pa)}aa.__tagsList__=!0}var Ma=[];la={};for(na=ha=0;na<ua.length;na++)if(0<ua[na].length){wa=aa[ua[na]];var Ia={};Ma=[];if(null!=wa)for(ka=
0;ka<wa.length;ka++)pa=wa[ka],0==ha==(null==la[pa.url])&&(Ia[pa.url]=!0,Ma.push(pa));la=Ia;ha++}0==Ma.length?za.innerText=mxResources.get("noResultsFor",[ja]):F(Ma,!0)}}function G(ja){if(Z!=ja||Q!=ca)t(),Ca.scrollTop=0,ea.innerText="",za.innerText=mxResources.get("searchResults")+' "'+ja+'"',Ua=null,da?J(ja):y&&(ja?(Ka.spin(ea),m=!1,T=!0,y(ja,Va,function(){n(mxResources.get("searchFailed"));Va([])},Q?null:l)):C(Q)),Z=ja,ca=Q}function P(ja){null!=Ua&&clearTimeout(Ua);13==ja.keyCode?G(xa.value):Ua=