Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
libs:ia.getAttribute("libs"),clibs:ia.getAttribute("clibs"),title:ia.getAttribute("title")}),ia=ia.nextSibling;S(Ia)}});var Va=function(ia,aa,la){Ca.style.display="";Qa.stop();V=!1;if(k)k=!1;else if(aa)ea.innerText=aa;else{la=la||{};aa=0;for(var ma in la)aa+=la[ma].length;0==ia.length&&0==aa?ea.innerText=mxResources.get("noDiagrams"):A(ia,!1,W,0==aa?null:la)}};z(T);var Ua=null;mxEvent.addListener(xa,"keyup",M);mxEvent.addListener(xa,"search",M);mxEvent.addListener(xa,"input",M);mxEvent.addListener(ka,
"click",function(ia){B(!1,!1)});R&&mxEvent.addListener(Aa,"click",function(ia){B(!1,!0)});J&&mxEvent.addListener(O.querySelector(".geTempDlgLinkToDiagramBtn"),"click",function(ia){B(!0)});mxEvent.addListener(O.querySelector(".geTempDlgCancelBtn"),"click",function(){null!=m&&m();e||b.hideDialog(!0)})};TemplatesDialog.tagsList={};