Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ua.innerText=ka;ha.appendChild(ua);qa.appendChild(ha);mxEvent.addListener(ha,"click",function(){function Ma(){var Aa=Ia.querySelector(".geTemplateDrawioCatLink");null!=Aa?Aa.click():setTimeout(Ma,200)}da=!0;var Ia=N.querySelector(".geTemplatesList");Ia.style.display="block";Ca.style.width="";xa.style.display="";xa.value="";Z=null;Ma()});ma.style.display=ja.length<=la?"none":""}function p(ja,aa,la){function na(La,Xa){La=mxResources.get(La,null,La.substring(0,1).toUpperCase()+La.substring(1));var Sa=