Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Ha.substring(Ha.indexOf(",")+1);Sa.style.cursor="pointer";Sa.style.width="100%";Sa.style.height="100%";na.appendChild(Sa);ra=b.createMermaidXml("%% Input: "+Na+"\n"+ra,EditorUi.defaultMermaidConfig,Ha,La,Xa);var Ta="<mxfile><diagram>"+Graph.compress(ra)+"</diagram></mxfile>";if(Ia||"undefined"===typeof mxMermaidToDrawio)ba=ma=ra;ra=m.cloneNode(!0);na.appendChild(ra);Ha=function(Pa){R=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display};La=function(Pa){R||A(Ta,mxEvent.getClientX(Pa),mxEvent.getClientY(Pa),
Sa,Na)};mxEvent.addGestureListeners(Sa,Ha,null,La);mxEvent.addGestureListeners(ra,Ha,null,La)},function(ra){b.handleError(ra)})});Ma.setAttribute("disabled","disabled");Ma.className="geBtn gePrimaryBtn";pa=function(){window.setTimeout(function(){""!=la.value?Ma.removeAttribute("disabled"):Ma.setAttribute("disabled","disabled")},0)};ka=urlParams["smart-template"];null!=ka&&"1"!=ka&&(la.value=decodeURIComponent(ka),pa(),"1"==urlParams["smart-template-generate"]&&window.setTimeout(function(){Ma.click()},