Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.createParentLookup=function(b,f){function m(N){var H=d[N];null==H&&(H={inserted:[],moved:{}},d[N]=H);return H}var d={};if(null!=f[EditorUi.DIFF_INSERT])for(var u=0;u<f[EditorUi.DIFF_INSERT].length;u++){var v=f[EditorUi.DIFF_INSERT][u],E=null!=v.parent?v.parent:"",F=null!=v.previous?v.previous:"";m(E).inserted[F]=v}if(null!=f[EditorUi.DIFF_UPDATE])for(var L in f[EditorUi.DIFF_UPDATE])v=f[EditorUi.DIFF_UPDATE][L],null!=v.previous&&(E=v.parent,null==E&&(u=b.getCell(L),null!=u&&(u=