Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p.firstChild;null!=p;){if(null!=p&&1==p.nodeType){var x=n.appendChild(g.importNode(p,!0));this.importNodes(g,x,k,c)}p=p.nextSibling}}}};m.prototype.layerIndexToNames=function(g){var b=[];if(g)for(var a=0;a<g.length;a++){var c=parseInt(g[a]);c<this.layerNames.length&&b.push(this.layerNames[c])}return 0<b.length?b:[mxResources.get("background")]};m.prototype.importPage=function(g,b,a,c){var d=g.getBackPage();if(null!=d){b.getModel().setValue(b.getDefaultParent(),g.getPageName());var f=new mxCell(d.getPageName());