Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=u.TextAreas.Text.Value&&null!=u.TextAreas.Text.Value.m)return u.TextAreas.Text.Value.m}else{if(null!=u.m)return u.m;if(null!=u.Title){if(null!=u.Title.m)return u.Title.m}else if(null!=u.State){if(null!=u.State.m)return u.State.m}else if(null!=u.Note&&null!=u.Note.m)return u.Note.m}return null}function a(u,F){u="whiteSpace=wrap;"+(F?"overflow=block;blockSpacing=1;html=1;fontSize=13;"+lb:f(u)+k(u)+p(u)+x(u)+E(u)+I(u)+J(u)+O(u)+M(u))+L(u)+H(u)+Zb(mxConstants.STYLE_ALIGN,u.TextAlign,"center");lb=
"";return u}function c(u,F,C,t,e,N){N=null==N?!1:N;var r="",q=!1,Z=!1;if(null!=u)if(N){N=u.split(";");u="";for(var aa=0;aa<N.length;aa++)"fillColor=none"==N[aa]?Z=!0:"strokeColor=none"==N[aa]?q=!0:""!=N[aa]&&(u+=N[aa]+";")}else""!=u&&";"!=u.charAt(u.length-1)&&(r=";");r+=(Xc(u,"whiteSpace")?"":"whiteSpace=wrap;")+(e?(Xc(u,"overflow")?"":"overflow=block;blockSpacing=1;")+(Xc(u,"html")?"":"html=1;")+"fontSize=13;"+lb:d(mxConstants.STYLE_FONTSIZE,u,F,C,t)+d(mxConstants.STYLE_FONTFAMILY,u,F,C,t)+d(mxConstants.STYLE_FONTCOLOR,