Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
document.createElement("span"),v.setAttribute("title",mxResources.get("help")),v.style.cssText="color:#a3a3a3;text-decoration:none;margin-right:2px;cursor:pointer;",mxUtils.write(v,"?"),mxEvent.addGestureListeners(v,mxUtils.bind(this,function(Q){this.openLink(EditorUi.scratchpadHelpLink);mxEvent.consume(Q)})),G.insertBefore(v,G.firstChild))}O.appendChild(G);O.style.paddingRight=18*G.childNodes.length+"px"}};EditorUi.prototype.addLibraryEntries=function(d,f){for(var k=0;k<d.length;k++){var v=d[k],
z=v.data;if(null!=z){z=this.convertDataUri(z);var A="shape=image;verticalLabelPosition=bottom;verticalAlign=top;imageAspect=0;";"fixed"==v.aspect&&(A+="aspect=fixed;");f.appendChild(this.sidebar.createVertexTemplate(A+"image="+z,v.w,v.h,"",v.title||"",!1,null,!0))}else null!=v.xml&&(z=this.stringToCells("<"==v.xml.charAt(0)?v.xml:Graph.decompress(v.xml)),0<z.length&&f.appendChild(this.sidebar.createVertexTemplateFromCells(z,v.w,v.h,v.title||"",!0,null,!0)))}};EditorUi.prototype.getResource=function(d){return null!=