Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
H.setAttribute("type","range");H.setAttribute("min","2");H.setAttribute("max","30");H.setAttribute("value",E.freehand.getBrushSize());H.style.width="90%";H.style.visibility="hidden";F.appendChild(H);mxUtils.br(F);N=function(){E.freehand.setPerfectFreehandMode(L.checked);H.style.visibility=L.checked?"visible":"hidden"};mxEvent.addListener(L,"change",N);N();mxEvent.addListener(H,"change",function(){E.freehand.setBrushSize(parseInt(this.value))})}var R=mxUtils.button(mxResources.get("startDrawing"),