Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
FilenameDialog.createTypeHint=function(b,e,g){var n=document.createElement("img");n.style.backgroundPosition="center bottom";n.style.backgroundRepeat="no-repeat";n.style.margin="2px 0 0 4px";n.style.verticalAlign="top";n.style.cursor="pointer";n.style.height="16px";n.style.width="16px";mxUtils.setOpacity(n,70);var y=function(){n.setAttribute("src",Editor.helpImage);n.setAttribute("title",mxResources.get("help"));for(var q=0;q<g.length;q++)if(0<g[q].ext.length&&e.value.toLowerCase().substring(e.value.length-
g[q].ext.length-1)=="."+g[q].ext){n.setAttribute("title",mxResources.get(g[q].title));break}};mxEvent.addListener(e,"keyup",y);mxEvent.addListener(e,"change",y);mxEvent.addListener(n,"click",function(q){var E=n.getAttribute("title");n.getAttribute("src")==Editor.helpImage?b.editor.graph.openLink(FilenameDialog.filenameHelpLink):""!=E&&b.showError(null,E,mxResources.get("help"),function(){b.editor.graph.openLink(FilenameDialog.filenameHelpLink)},null,mxResources.get("ok"),null,null,null,340,90);mxEvent.consume(q)});