Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
}finally{e.getModel().endUpdate()}t&&(e.setSelectionCell(g),e.scrollCellToVisible(g))}};m=mxUtils.button(mxResources.get("preview"),function(){c(H,R,!1)});m.className="geBtn";L.appendChild(m);m=mxUtils.button(mxResources.get("apply"),function(){c(b.editor.graph,f,!0)});m.className="geBtn gePrimaryBtn";L.appendChild(m);b.editor.cancelFirst||L.appendChild(u);F.appendChild(L);E.appendChild(F);v.appendChild(E);this.container=v},CustomDialog=function(b,f,m,d,u,v,E,F,L,N,H,R){var J=document.createElement("div");