Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Fa.substring(Fa.indexOf(",")+1);Pa.style.cursor="pointer";Pa.style.width="100%";Pa.style.height="100%";ma.appendChild(Pa);ra=b.createMermaidXml("%% Input: "+Ma+"\n"+ra,EditorUi.defaultMermaidConfig,Fa,Ka,Xa);var Ra="<mxfile><diagram>"+Graph.compress(ra)+"</diagram></mxfile>";if(Ga||"undefined"===typeof mxMermaidToDrawio)ba=na=ra;ra=k.cloneNode(!0);ma.appendChild(ra);Fa=function(Oa){P=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display};Ka=function(Oa){P||x(Ra,mxEvent.getClientX(Oa),mxEvent.getClientY(Oa),
Pa,Ma)};mxEvent.addGestureListeners(Pa,Fa,null,Ka);mxEvent.addGestureListeners(ra,Fa,null,Ka)},function(ra){b.handleError(ra)})});La.setAttribute("disabled","disabled");La.className="geBtn gePrimaryBtn";oa=function(){window.setTimeout(function(){""!=la.value?La.removeAttribute("disabled"):La.setAttribute("disabled","disabled")},0)};ja=urlParams["smart-template"];null!=ja&&"1"!=ja&&(la.value=decodeURIComponent(ja),oa(),"1"==urlParams["smart-template-generate"]&&window.setTimeout(function(){La.click()},