Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Math.random()))):A.toUpperCase()!=A?l.push(String.fromCharCode(97+Math.round(25*Math.random()))):/\s/.test(A)?l.push(" "):l.push("?"):l.push(f?"0":Math.round(9*Math.random()))}return l.join("")};EditorUi.prototype.anonymizePatch=function(d){if(null!=d[EditorUi.DIFF_INSERT])for(var f=0;f<d[EditorUi.DIFF_INSERT].length;f++)try{var l=mxUtils.parseXml(d[EditorUi.DIFF_INSERT][f].data).documentElement.cloneNode(!1);null!=l.getAttribute("name")&&l.setAttribute("name",this.anonymizeString(l.getAttribute("name")));
d[EditorUi.DIFF_INSERT][f].data=mxUtils.getXml(l)}catch(B){d[EditorUi.DIFF_INSERT][f].data=B.message}if(null!=d[EditorUi.DIFF_UPDATE]){for(var u in d[EditorUi.DIFF_UPDATE]){var A=d[EditorUi.DIFF_UPDATE][u];null!=A.name&&(A.name=this.anonymizeString(A.name));null!=A.cells&&(f=mxUtils.bind(this,function(B){var F=A.cells[B];if(null!=F){for(var M in F)null!=F[M].value&&(F[M].value="["+F[M].value.length+"]"),null!=F[M].xmlValue&&(F[M].xmlValue="["+F[M].xmlValue.length+"]"),null!=F[M].style&&(F[M].style=
"["+F[M].style.length+"]"),mxUtils.isEmptyObject(F[M])&&delete F[M];mxUtils.isEmptyObject(F)&&delete A.cells[B]}}),f(EditorUi.DIFF_INSERT),f(EditorUi.DIFF_UPDATE),mxUtils.isEmptyObject(A.cells)&&delete A.cells);mxUtils.isEmptyObject(A)&&delete d[EditorUi.DIFF_UPDATE][u]}mxUtils.isEmptyObject(d[EditorUi.DIFF_UPDATE])&&delete d[EditorUi.DIFF_UPDATE]}return d};EditorUi.prototype.anonymizeAttributes=function(d,f){if(null!=d.attributes)for(var l=0;l<d.attributes.length;l++)"as"!=d.attributes[l].name&&