Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
na[Xa],0<ja.length&&(pa=document.createElement("div"),pa.className="geTempDlgImportCat",pa.innerText=mxResources.get(Xa,null,Xa),ea.appendChild(pa),F(ja,aa,la,null,!0))}function S(ja,aa){qa.innerText="";A();var la=Math.floor(qa.offsetWidth/150)-1;aa=!aa&&ja.length>la?la:ja.length;for(var na=0;na<aa;na++){var pa=ja[na];pa.isCategory=!0;var ha=document.createElement("div"),ka=mxResources.get(pa.title);null==ka&&(ka=pa.title.substring(0,1).toUpperCase()+pa.title.substring(1));ha.className="geTempDlgNewDiagramCatItem";
ha.setAttribute("title",ka);ka=mxUtils.htmlEntities(ka);15<ka.length&&(ka=ka.substring(0,15)+"&hellip;");null==R&&(L(!0),A(ha,"geTempDlgNewDiagramCatItemActive",pa));var ua=document.createElement("div");ua.className="geTempDlgNewDiagramCatItemImg";var wa=document.createElement("img");wa.src=NEW_DIAGRAM_CATS_PATH+"/"+pa.img;ua.appendChild(wa);ha.appendChild(ua);ua=document.createElement("div");ua.className="geTempDlgNewDiagramCatItemLbl";ua.innerHTML=ka;ha.appendChild(ua);qa.appendChild(ha);(function(Ma,
Ia){mxEvent.addListener(ha,"click",function(){R!=Ia&&(L(!0),A(Ia,"geTempDlgNewDiagramCatItemActive",Ma))});mxEvent.addListener(ha,"dblclick",H)})(pa,ha)}ha=document.createElement("div");ha.className="geTempDlgNewDiagramCatItem";ka=mxResources.get("showAllTemps");ha.setAttribute("title",ka);ua=document.createElement("div");ua.className="geTempDlgNewDiagramCatItemImg";ua.innerText="...";ua.style.fontSize="32px";ha.appendChild(ua);ua=document.createElement("div");ua.className="geTempDlgNewDiagramCatItemLbl";
ua.innerText=ka;ha.appendChild(ua);qa.appendChild(ha);mxEvent.addListener(ha,"click",function(){function Ma(){var Aa=Ia.querySelector(".geTemplateDrawioCatLink");null!=Aa?Aa.click():setTimeout(Ma,200)}da=!0;var Ia=N.querySelector(".geTemplatesList");Ia.style.display="block";Ca.style.width="";xa.style.display="";xa.value="";Z=null;Ma()});ma.style.display=ja.length<=la?"none":""}function p(ja,aa,la){function na(La,Xa){La=mxResources.get(La,null,La.substring(0,1).toUpperCase()+La.substring(1));var Sa=