Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K.pagecount=null!=c.pages?c.pages.length:1;K.page=null!=c.currentPage?c.currentPage.getName():"";K.pagenumber=null!=c.pages&&null!=c.currentPage?mxUtils.indexOf(c.pages,c.currentPage)+1:1;return K};var l=e.getGlobalVariable;e.getGlobalVariable=function(K){var O=c.getCurrentFile();return"filename"==K&&null!=O?O.getTitle():"page"==K&&null!=c.currentPage?c.currentPage.getName():"pagenumber"==K?null!=c.currentPage&&null!=c.pages?mxUtils.indexOf(c.pages,c.currentPage)+1:1:"pagecount"==K?null!=c.pages?
c.pages.length:1:l.apply(this,arguments)};var n=null;this.addListener("fileDescriptorChanged",function(){var K=this.getCurrentFile();null!=K&&n!=K.getTitle()&&(n=null!=K.getTitle()?K.getTitle():this.defaultFilename,e.invalidateDescendantsWithPlaceholders(e.model.getRoot()),e.view.validate())});var z=e.labelLinkClicked;e.labelLinkClicked=function(K,O,V){var k=O.getAttribute("href");if(null==k||!e.isCustomLink(k)||!mxEvent.isTouchEvent(V)&&mxEvent.isPopupTrigger(V))z.apply(this,arguments);else{if(!e.isEnabled()||