Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
retry:k})}),mxUtils.bind(this,function(){l&&(window.onGitLabCallback=null,l=!1,c({message:mxResources.get("accessDenied"),retry:k}))}))});k()}else c({code:App.ERROR_BUSY})};GitLabClient.prototype.executeRequest=function(e,f,c,k){var l=mxUtils.bind(this,function(y){var E=!0,D=window.setTimeout(mxUtils.bind(this,function(){E=!1;c({code:App.ERROR_TIMEOUT,message:mxResources.get("timeout")})}),this.ui.timeout),z=this.authToken+" "+b;e.setRequestHeaders=function(M,I){M.setRequestHeader("Authorization",
z);M.setRequestHeader("PRIVATE_TOKEN",z);M.setRequestHeader("Content-Type","application/json")};e.send(mxUtils.bind(this,function(){window.clearTimeout(D);if(E)if(200<=e.getStatus()&&299>=e.getStatus()||k&&404==e.getStatus())f(e);else if(401===e.getStatus())y?c({message:mxResources.get("accessDenied"),retry:mxUtils.bind(this,function(){this.authenticate(function(){x(!0)},c)})}):this.authenticate(function(){l(!0)},c);else if(403===e.getStatus()){var M=!1;try{var I=JSON.parse(e.getText());null!=I&&