Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function q(F){null!=F&&(F=p(Editor.parseDiagramNode(F)));return F}mxEvent.addListener(T,"change",function(F){H=parseInt(T.value);q(L[H]);mxEvent.consume(F)});if("mxfile"==B.nodeName){var C=B.getElementsByTagName("diagram");L=[];for(var J=0;J<C.length;J++)L.push(C[J]);0<L.length&&q(L[H]);T.innerText="";if(1<L.length)for(T.style.display="",J=0;J<L.length;J++)C=document.createElement("option"),mxUtils.write(C,L[J].getAttribute("name")||mxResources.get("pageWithNumber",[J+1])),C.setAttribute("value",