Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.addTabListeners=function(b,e){mxEvent.disableContextMenu(e);var g=this.editor.graph;mxEvent.addListener(e,"dblclick",mxUtils.bind(this,function(T){this.renamePage(b);mxEvent.consume(T)}));var p=document.createElement("div");p.className="geTabMenuButton";p.style.backgroundImage="url("+mxWindow.prototype.minimizeImage+")";p.style.backgroundPosition="center center";p.style.backgroundRepeat="no-repeat";p.style.backgroundSize="10px";e.appendChild(p);var y=!1,q=!1,E=mxUtils.bind(this,
function(T){y=null!=this.currentMenu;q=b==this.currentPage;g.isMouseDown||q||this.selectPage(b);this.scrollToPage()}),M=mxUtils.bind(this,function(T){if(g.isEnabled()&&!g.isMouseDown&&(q&&(mxEvent.isTouchEvent(T)||mxEvent.getSource(T)==p)||mxEvent.isPopupTrigger(T))&&(g.popupMenuHandler.hideMenu(),this.hideCurrentMenu(),!mxEvent.isTouchEvent(T)||!y)){var F=new mxPopupMenu(this.createPageMenu(b));F.div.className+=" geMenubarMenu";F.smartSeparators=!0;F.showDisabled=!0;F.autoExpand=!0;F.hideMenu=mxUtils.bind(this,
function(){mxPopupMenu.prototype.hideMenu.apply(F,arguments);this.resetCurrentMenu();F.destroy()});var K=mxEvent.getClientX(T),R=mxEvent.getClientY(T);F.popup(K,R,null,T);this.setCurrentMenu(F,e)}mxEvent.consume(T)});mxEvent.addGestureListeners(p,E,null,M);mxEvent.addGestureListeners(e,E,null,M)};