Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){Trello.get("search",{query:""==mxUtils.trim(c)?"is:open":c,cards_limit:100,cards_page:g-1},mxUtils.bind(this,function(u){this.ui.spinner.stop();u=null!=u?u.cards:null;if(null==u||0==u.length)mxUtils.write(y,mxResources.get("noFiles"));else{1==g&&(y.appendChild(E(mxResources.get("filterCards")+"...",mxUtils.bind(this,function(){var A=new FilenameDialog(this.ui,c,mxResources.get("ok"),mxUtils.bind(this,function(H){null!=H&&(c=H,d())}),mxResources.get("filterCards"),null,null,"http://help.trello.com/article/808-searching-for-cards-all-boards");
this.ui.showDialog(A.container,300,80,!0,!1);A.init()}))),mxUtils.br(y));for(var v=0;v<u.length;v++)mxUtils.bind(this,function(A){y.appendChild(E(A.name,mxUtils.bind(this,function(){b?(f=A.id,z()):(this.ui.hideDialog(),e(A.id))})))})(u[v]);100==u.length&&(y.appendChild(M),I=function(){y.scrollTop>=y.scrollHeight-y.offsetHeight&&n()},mxEvent.addListener(y,"scroll",I))}}),mxUtils.bind(this,function(u){401==u.status?this.authenticate(t,D,!0):null!=D&&D({message:u.responseText})}))});t()});d()};