Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.diffPage=function(b,f){var m=[],d=[],u={};this.updatePageRoot(b);this.updatePageRoot(f);f=this.createCellLookup(f.root);var v=this.diffCellRecursive(b.root,null,f,v,d),E;for(E in f)b=f[E],m.push(this.getJsonForCell(b.cell,b.prev));mxUtils.isEmptyObject(v)||(u[EditorUi.DIFF_UPDATE]=v);0<d.length&&(u[EditorUi.DIFF_REMOVE]=d);0<m.length&&(u[EditorUi.DIFF_INSERT]=m);return u};