Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
fa[la]=ma),ma.push(oa))}ia=ia.nextSibling}l(Ea,Ta,Ha)}})}function z(ia){E&&(Ba.scrollTop=0,ea.innerText="",Qa.spin(ea),k=!1,V=!0,za.innerText=mxResources.get("recentDiag"),Z=null,E(Va,function(){g(mxResources.get("cannotLoad"));Va([])},ia?null:v))}function C(ia){if(""==ia)null!=G&&(G.click(),G=null);else{if(null==TemplatesDialog.tagsList[d]){var aa={};for(La in Ea)for(var la=Ea[La],ma=0;ma<la.length;ma++){var oa=la[ma];if(null!=oa.tags)for(var fa=oa.tags.toLowerCase().split(";"),ja=0;ja<fa.length;ja++)null==
aa[fa[ja]]&&(aa[fa[ja]]=[]),aa[fa[ja]].push(oa)}TemplatesDialog.tagsList[d]=aa}var sa=ia.toLowerCase().split(" ");aa=TemplatesDialog.tagsList[d];if(0<Ha&&null==aa.__tagsList__){for(La in Ta)for(la=Ta[La],ma=0;ma<la.length;ma++)for(oa=la[ma],fa=oa.title.split(" "),fa.push(La),ja=0;ja<fa.length;ja++){var ta=fa[ja].toLowerCase();null==aa[ta]&&(aa[ta]=[]);aa[ta].push(oa)}aa.__tagsList__=!0}var La=[];la={};for(ma=fa=0;ma<sa.length;ma++)if(0<sa[ma].length){ta=aa[sa[ma]];var Ga={};La=[];if(null!=ta)for(ja=
0;ja<ta.length;ja++)oa=ta[ja],0==fa==(null==la[oa.url])&&(Ga[oa.url]=!0,La.push(oa));la=Ga;fa++}0==La.length?za.innerText=mxResources.get("noResultsFor",[ia]):A(La,!0)}}function D(ia){if(Z!=ia||T!=ca)q(),Ba.scrollTop=0,ea.innerText="",za.innerText=mxResources.get("searchResults")+' "'+ia+'"',Ua=null,ha?C(ia):F&&(ia?(Qa.spin(ea),k=!1,V=!0,F(ia,Va,function(){g(mxResources.get("searchFailed"));Va([])},T?null:v)):z(T)),Z=ia,ca=T}function M(ia){null!=Ua&&clearTimeout(Ua);13==ia.keyCode?D(xa.value):Ua=