Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
libs:ja.getAttribute("libs"),clibs:ja.getAttribute("clibs"),title:ja.getAttribute("title")}),ja=ja.nextSibling;S(Fa)}});var Va=function(ja,aa,la){Ba.style.display="";Ka.stop();T=!1;if(m)m=!1;else if(aa)ea.innerText=aa;else{la=la||{};aa=0;for(var na in la)aa+=la[na].length;0==ja.length&&0==aa?ea.innerText=mxResources.get("noDiagrams"):F(ja,!1,V,0==aa?null:la)}};C(Q);var Ua=null;mxEvent.addListener(xa,"keyup",P);mxEvent.addListener(xa,"search",P);mxEvent.addListener(xa,"input",P);mxEvent.addListener(ia,
"click",function(ja){H(!1,!1)});M&&mxEvent.addListener(ya,"click",function(ja){H(!1,!0)});I&&mxEvent.addListener(N.querySelector(".geTempDlgLinkToDiagramBtn"),"click",function(ja){H(!0)});mxEvent.addListener(N.querySelector(".geTempDlgCancelBtn"),"click",function(){null!=f&&f();g||b.hideDialog(!0)})};TemplatesDialog.tagsList={};