Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(null==na&&(ha=pa.indexOf("/"),na=pa.substring(0,ha),null==la)){var ka=pa.indexOf("/",ha+1);-1<ka&&(la=pa.substring(ha+1,ka))}ha=Ea[na];null==ha&&(Ra++,ha=[],Ea[na]=ha);pa=ja.getAttribute("clibs");null!=aa[pa]&&(pa=aa[pa]);pa={url:ja.getAttribute("url"),libs:ja.getAttribute("libs"),title:ja.getAttribute("title")||ja.getAttribute("name"),preview:ja.getAttribute("preview"),clibs:pa,tags:ja.getAttribute("tags")};ha.push(pa);null!=la&&(ha=Da[na],null==ha&&(ha={},Da[na]=ha),na=ha[la],null==na&&(na=[],
ha[la]=na),na.push(pa))}ja=ja.nextSibling}p(Ea,Qa,Ga)}})}function C(ja){x&&(Ca.scrollTop=0,ea.innerText="",Ka.spin(ea),m=!1,T=!0,za.innerText=mxResources.get("recentDiag"),Z=null,x(Va,function(){n(mxResources.get("cannotLoad"));Va([])},ja?null:l))}function J(ja){if(""==ja)null!=K&&(K.click(),K=null);else{if(null==TemplatesDialog.tagsList[c]){var aa={};for(Ma in Ea)for(var la=Ea[Ma],na=0;na<la.length;na++){var pa=la[na];if(null!=pa.tags)for(var ha=pa.tags.toLowerCase().split(";"),ka=0;ka<ha.length;ka++)null==