Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
La-l&&(U+=e(na)+r(u,l,La),l=La);for(;null!=Ea&&Ea.s==La;)na[Ea.n]=Ea,Ea=aa[++ja];U+=e(na)}else if(Ra){if(Ra.e>Ia)break;l=Ra.e;do delete na[Ra.n],Ra=ra[++Aa];while(null!=Ra&&Ra.e==l);U+=r(u,La,l);La=l;0!=Pa.length||null!=Ea&&Ea.s==l||(aa.splice(ja,0,{s:l,n:"dummy",v:""}),ra.splice(Aa,0,{e:Ea?Ea.s:Ia,n:"dummy",v:""}))}else break}U+=r(null,null,null,!0);ua&&(l!=Ia&&(U+=e({dummy:1})+r(u,l,Ia)),U+=N(!0));return U}function m(u,F){G=!1;var C=null!=u.Text&&u.Text.t?u.Text:null!=u.Value&&u.Value.t?u.Value:
null!=u.Lane_0&&u.Lane_0.t?u.Lane_0:null;null==C&&null!=u.State?u.State.t&&(C=u.State):null==C&&null!=u.Note?u.Note.t&&(C=u.Note):null==C&&null!=u.Title?u.Title.t&&(C=u.Title):u.t&&(C=u);null==C&&null!=u.TextAreas?null!=u.TextAreas.Text&&null!=u.TextAreas.Text.Value&&u.TextAreas.Text.Value.t&&(C=u.TextAreas.Text.Value):null==C&&null!=u.t0&&u.t0.t&&(C=u.t0);if(null!=C){if(null!=C.t){var t=C.t;t=t.replace(/\u2028/g,"\n");C=C.m;try{/   /.test(t)&&(LucidImporter.hasUnknownShapes=!0);for(var e=0;e<C.length;e++)if(0<
C[e].s||null!=C[e].e&&C[e].e<t.length||"t"==C[e].n||"ac"==C[e].n||"lk"==C[e].n){G=!0;break}if(G=G||F)return B(t,C,u)}catch(N){console.log(N)}t=t.replace(/</g,"&lt;");return t=t.replace(/>/g,"&gt;")}if(null!=C.Value&&null!=C.Value.t)return C.Value.t=C.Value.t.replace(/</g,"&lt;"),C.Value.t=C.Value.t.replace(/>/g,"&gt;"),C.Value.t}return""}function g(u){return null!=u.Action?u.Action:u}function b(u){if(null!=u.Text){if(null!=u.Text.m)return u.Text.m}else if(null!=u.TextAreas){if(null!=u.TextAreas.Text&&