Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function N(la){var Ma="";do{var ya=Ca.pop();if(!la&&Na&&("ul"==ya||"ol"==ya)){Ca.push(ya);break}Ma+="</"+ya+">"}while(0<Ca.length);return Ma}function r(la,Ma,ya,za){la=la?la.substring(Ma,ya):"";Na&&(la=la.trim());0==Ba.length&&0<la.length&&(la=e({dummy:1})+la);la=la.replace(/</g,"&lt;").replace(/>/g,"&gt;");do for(Ma=Pa.pop(),ya=0;ya<Ma;ya++){var Qb=Ba.pop();la+="</"+Qb+">"}while(za&&0<Ba.length);return la}var q={a:!0,il:!0,ir:!0,mt:!0,mb:!0,p:!0,t:!0,l:!0},Z={lk:!0,s:!0,c:!0,b:!0,fc:!0,i:!0,u:!0,