Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
E;this.okButton=k;this.container=I},TemplatesDialog=function(b,e,f,c,k,l,x,y,E,D,z,M,I,d,g){function n(ja){ta.innerText=ja;ta.style.display="block";setTimeout(function(){ta.style.display="none"},4E3)}function t(){null!=B&&(B.style.fontWeight="normal",B.style.textDecoration="none",K=B,B=null)}function u(ja,aa,la,na,pa,ha,ka){if(-1<ja.className.indexOf("geTempDlgRadioBtnActive"))return!1;ja.className+=" geTempDlgRadioBtnActive";N.querySelector(".geTempDlgRadioBtn[data-id="+na+"]").className="geTempDlgRadioBtn "+
(ka?"geTempDlgRadioBtnLarge":"geTempDlgRadioBtnSmall");N.querySelector("."+aa).src="/images/"+la+"-sel.svg";N.querySelector("."+pa).src="/images/"+ha+".svg";return!0}function v(ja,aa,la,na){function pa(wa,Ma){null==ka?(wa=/^https?:\/\//.test(wa)&&!b.editor.isCorsEnabledForUrl(wa)?PROXY_URL+"?url="+encodeURIComponent(wa):TEMPLATE_PATH+"/"+wa,mxUtils.get(wa,mxUtils.bind(this,function(Ia){200<=Ia.getStatus()&&299>=Ia.getStatus()&&(ka=Ia.getText());Ma(ka)}))):Ma(ka)}function ha(wa,Ma,Ia){if(null!=wa&&