Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Math.max(0,A(.75*la.il.v-(Na?28:0)))+"px;");la.ir&&(ya+="margin-right: "+A(.75*la.ir.v)+"px;");la.mt&&(ya+="margin-top: "+A(.75*la.mt.v)+"px;");la.mb&&(ya+="margin-bottom: "+A(.75*la.mb.v)+"px;");ya+='margin-top: -2px;">';Na||(ya+="<span>",Ca.push("span"));return ya}function e(la){if(mxUtils.isEmptyObject(la))return"";var Ma="",ya=0;if(la.lk){var za=la.lk;null!=za.v&&0<za.v.length&&(Ma+='<a href="'+n(za.v[0])+'">',Ba.push("a"),ya++)}Ma+='<span style="';Ba.push("span");ya++;Ma+="font-size:"+(la.s&&
la.s.v?A(.75*la.s.v):"13")+"px;";la.c&&(za=T(la.c.v),null!=za&&(za=za.substring(0,7),Ma+="color:"+za+";"));if(la.b&&la.b.v||la.fc&&la.fc.v&&0==la.fc.v.indexOf("Bold"))Ma+="font-weight: bold;";la.i&&la.i.v&&(Ma+="font-style: italic;");la.ac&&la.ac.v&&(Ma+="text-transform: uppercase;");za=null;la.f?za=la.f.v:C.Font&&(za=C.Font);Ma+=y(za);za=[];la.u&&la.u.v&&za.push("underline");la.k&&la.k.v&&za.push("line-through");0<za.length&&(Ma+="text-decoration: "+za.join(" ")+";");Ma+='">';Pa.push(ya);return Ma}