Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0;ka<wa.length;ka++)pa=wa[ka],0==ha==(null==la[pa.url])&&(Ia[pa.url]=!0,Ma.push(pa));la=Ia;ha++}0==Ma.length?za.innerText=mxResources.get("noResultsFor",[ja]):F(Ma,!0)}}function G(ja){if(Z!=ja||Q!=ca)t(),Ca.scrollTop=0,ea.innerText="",za.innerText=mxResources.get("searchResults")+' "'+ja+'"',Ua=null,da?J(ja):y&&(ja?(Ka.spin(ea),m=!1,T=!0,y(ja,Va,function(){n(mxResources.get("searchFailed"));Va([])},Q?null:l)):C(Q)),Z=ja,ca=Q}function P(ja){null!=Ua&&clearTimeout(Ua);13==ja.keyCode?G(xa.value):Ua=
setTimeout(function(){G(xa.value)},1E3)}var O='<div class="geTempDlgHeader"><img src="/images/draw.io-logo.svg" class="geTempDlgHeaderLogo"><input type="search" class="geTempDlgSearchBox" '+(y?"":'style="display: none"')+' placeholder="'+mxResources.get("search")+'"></div><div class="geTemplatesList" style="display: none"><div class="geTempDlgBack">&lt; '+mxResources.get("back")+'</div><div class="geTempDlgHLine"></div><div class="geTemplatesLbl">'+mxResources.get("templates")+'</div></div><div class="geTempDlgContent" style="width: 100%"><div class="geTempDlgNewDiagramCat"><div class="geTempDlgNewDiagramCatLbl">'+