Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.pagecount=null!=d.pages?d.pages.length:1;O.page=null!=d.currentPage?d.currentPage.getName():"";O.pagenumber=null!=d.pages&&null!=d.currentPage?mxUtils.indexOf(d.pages,d.currentPage)+1:1;return O};var p=g.getGlobalVariable;g.getGlobalVariable=function(O){var N=d.getCurrentFile();return"filename"==O&&null!=N?N.getTitle():"page"==O&&null!=d.currentPage?d.currentPage.getName():"pagenumber"==O?null!=d.currentPage&&null!=d.pages?mxUtils.indexOf(d.pages,d.currentPage)+1:1:"pagecount"==O?null!=d.pages?
d.pages.length:1:p.apply(this,arguments)};var q=null;this.addListener("fileDescriptorChanged",function(){var O=this.getCurrentFile();null!=O&&q!=O.getTitle()&&(q=null!=O.getTitle()?O.getTitle():this.defaultFilename,g.invalidateDescendantsWithPlaceholders(g.model.getRoot()),g.view.validate())});var C=g.labelLinkClicked;g.labelLinkClicked=function(O,N,T){var m=N.getAttribute("href");if(null==m||!g.isCustomLink(m)||!mxEvent.isTouchEvent(T)&&mxEvent.isPopupTrigger(T))C.apply(this,arguments);else{if(!g.isEnabled()||