Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Ka+" ("+Xa.length+")",Ra=Ka=mxUtils.htmlEntities(Ka);15<Ka.length&&(Ka=Ka.substring(0,15)+"&hellip;");return{lbl:Ka+" ("+Xa.length+")",fullLbl:Pa,lblOnly:Ra}}function oa(Ka,Xa,Pa,Ra,Oa){mxEvent.addListener(Pa,"click",function(){y!=Pa&&(null!=y?(y.style.fontWeight="normal",y.style.textDecoration="none"):(da.style.display="none",ba.style.minHeight="100%"),y=Pa,y.style.fontWeight="bold",y.style.textDecoration="underline",Ba.scrollTop=0,V&&(k=!0),za.innerHTML=Xa,Ca.style.display="none",A(Oa?aa[Ka]:Ra?
Da[Ka][Ra]:ia[Ka],Oa?!1:!0))})}var fa=O.querySelector(".geTemplatesList");if(0<la){la=document.createElement("div");la.style.cssText="font-weight: bold;background: #f9f9f9;padding: 5px 0 5px 0;text-align: center;margin-top: 10px;";mxUtils.write(la,mxResources.get("custom"));fa.appendChild(la);for(var ja in aa){la=document.createElement("div");var sa=aa[ja];sa=ma(ja,sa);la.className="geTemplateCatLink";la.setAttribute("title",sa.fullLbl);la.innerHTML=sa.lbl;fa.appendChild(la);oa(ja,sa.lblOnly,la,null,