Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Fa.substring(Fa.indexOf(",")+1);Pa.style.cursor="pointer";Pa.style.width="100%";Pa.style.height="100%";ma.appendChild(Pa);ra=b.createMermaidXml("%% Input: "+Ma+"\n"+ra,EditorUi.defaultMermaidConfig,Fa,Ka,Xa);var Ra="<mxfile><diagram>"+Graph.compress(ra)+"</diagram></mxfile>";if(Ga||"undefined"===typeof mxMermaidToDrawio)ba=na=ra;ra=k.cloneNode(!0);ma.appendChild(ra);Fa=function(Oa){P=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display};Ka=function(Oa){P||x(Ra,mxEvent.getClientX(Oa),mxEvent.getClientY(Oa),