Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.repositionLibrary=function(c){var e=this.sidebar.getEntryContainer();if(null==c){var g=this.sidebar.palettes["L.scratchpad"];null==g&&(g=this.sidebar.palettes.search);null!=g&&(c=g[g.length-1].nextSibling)}c=null!=c?c:e.firstChild.nextSibling.nextSibling;g=e.lastChild;var q=g.previousSibling;e.insertBefore(g,c);e.insertBefore(q,g)};EditorUi.prototype.loadLibrary=function(c,e){var g=mxUtils.parseXml(c.getData());if("mxlibrary"==g.documentElement.nodeName){var q=JSON.parse(mxUtils.getTextContent(g.documentElement));