Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.appendChild(f));D.appendChild(d);D.appendChild(g);this.container=D},FindWindow=function(b,e,f,c,k,l){function x(T,m,B,K){if("object"===typeof m.value&&null!=m.value.attributes){m=m.value.attributes;for(var R=0;R<m.length;R++)if("label"!=m[R].nodeName){var U=mxUtils.trim(m[R].nodeValue.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")).toLowerCase();if(null==T&&(K&&0<=U.indexOf(B)||!K&&U.substring(0,B.length)===B)||null!=T&&T.test(U))return!0}}return!1}function y(){d?(P.removeAttribute("disabled"),O.removeAttribute("disabled")):