Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.debug("[Performance] EditorUi.clonePages",[this],"time",Date.now()-l+" ms","args",arguments);return y});null!=K?(c.getHashValueForPages=K,K=null):(K=c.getHashValueForPages,c.getHashValueForPages=function(){var l=Date.now(),y=K.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.getHashValueForPages",[this],"time",Date.now()-l+" ms","args",arguments);return y});null!=H?(c.resolveCrossReferences=H,H=null):(H=c.resolveCrossReferences,c.resolveCrossReferences=function(){var l=Date.now(),
y=H.apply(this,arguments);EditorUi.debug("[Performance] EditorUi.resolveCrossReferences",[this],"time",Date.now()-l+" ms","args",arguments);return y});EditorUi.debug("[Performance]",null!=q?"Enabled":"Disabled")}));this.put("testDevelop",new Menu(mxUtils.bind(this,function(l,y){this.addMenuItems(l,"createSidebarEntry showBoundingBox - testCheckPages testChecksum testFixPages - testCheckFile testDiff - testInspect testOptimize - testXmlImageExport -".split(" "),y);var J=l.addItem(mxResources.get("testPerformance"),