Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
break;case "italic":Xa+="font-style: italic;";break;case "underline":Xa+="text-decoration: underline;";break;case "size":Xa+="font-size:"+A(.75*Gc)+"px;";break;case "color":Xa+="color:"+T(Gc).substring(0,7)+";";break;case "fill":Xa+="background-color:"+T(Gc).substring(0,7)+";";break;case "align":Xa+="text-align:"+Gc+";"}}break}}}catch(Sd){}return Xa}try{var r=function(Lb,$b,Xa){Lb=Aa+Lb;ra[Lb]=$b;$b="";for(var pb=0;pb<U.length;pb++)$b+='<div style="'+ma[pb]+'">'+(Xa[U[pb]]||"&nbsp;")+"</div>";pb=
mxUtils.getSizeForString($b);Xa=h(Xa.Image||Xa["018__ImageUrl__"])||"https://cdn4.iconfinder.com/data/icons/basic-user-interface-elements/700/user-account-profile-human-avatar-face-head--128.png";Xa=new mxCell($b,new mxGeometry(0,0,pb.width+Ba,pb.height+Pa),ua+(Ca?Xa:""));Xa.vertex=!0;e[Lb]=Xa;t.addCell(Xa,aa)},q=F.OrgChartBlockType,Z=F.Location,aa=new mxCell("",new mxGeometry(.75*Z.x,.75*Z.y,200,100),"group");aa.vertex=!0;t.addCell(aa);var U=F.FieldNames,wa=F.LayoutSettings,ja=F.BlockItemDefaultStyle||