Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
AspectDialog.prototype.createPageItem=function(b,f,m){var d=document.createElement("div");d.className="geAspectDlgListItem";d.setAttribute("data-page-id",b);d.innerHTML='<div style="max-width: 100%; max-height: 100%;"></div><div class="geAspectDlgListItemText">'+mxUtils.htmlEntities(f)+"</div>";this.pagesContainer.appendChild(d);var u=this.createViewer(d.childNodes[0],m);f=mxUtils.bind(this,function(){null!=this.selectedItem&&(this.selectedItem.className="geAspectDlgListItem");this.selectedItem=d;
this.selectedPage=b;d.className+=" geAspectDlgListItemSelected";this.layersContainer.innerText="";this.selectedLayers={};this.okBtn.setAttribute("disabled","disabled");var v=u.model;v=v.getChildCells(v.getRoot());for(var E=0;E<v.length;E++)this.createLayerItem(v[E],b,u,m)});mxEvent.addListener(d,"click",f);this.aspect.pageId==b&&f()};