Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Actions.prototype.addAction=function(b,e,g,n,y){if("..."==b.substring(b.length-3)){b=b.substring(0,b.length-3);var q=mxResources.get(b)+"..."}else q=mxResources.get(b);return this.put(b,new Action(q,e,g,n,y))};Actions.prototype.put=function(b,e){return this.actions[b]=e};Actions.prototype.get=function(b){return this.actions[b]};