Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(Oa){R=b.sidebar.currentElt==ra}),null,null),mxEvent.addListener(ha,"click",mxUtils.bind(this,function(Oa){R||Na(Oa,null!=na?na:pa);mxEvent.consume(Oa)})));fa.appendChild(ra);return ra}function p(){function aa(ra,Ha){ra=mxResources.get(ra,null,ra.substring(0,1).toUpperCase()+ra.substring(1));18<ra.length&&(ra=ra.substring(0,18)+"&hellip;");return ra+(null!=Ha?" ("+Ha.length+")":"")}function la(ra,Ha,La){mxEvent.addListener(Ha,"click",function(){Fa!=Ha&&(Fa.style.backgroundColor=