Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"ellipsis";D.setAttribute("title",C.title+" ("+C.id+")");var M=document.createElement("input");M.setAttribute("type","checkbox");M.checked=b.sidebar.isEntryVisible(C.id);M.defaultChecked=M.checked;D.appendChild(M);mxUtils.write(D," "+C.title);H.appendChild(D);var K=function(O){if(null==O||"INPUT"!=mxEvent.getSource(O).nodeName){R.style.textAlign="center";R.style.padding="0px";R.style.color="";R.innerText="";if(null!=C.desc){var V=document.createElement("pre");V.style.boxSizing="border-box";V.style.fontFamily=
"inherit";V.style.margin="20px";V.style.right="0px";V.style.textAlign="left";mxUtils.write(V,C.desc);R.appendChild(V)}null!=C.imageCallback?C.imageCallback(R):null!=C.image?R.innerHTML+='<img border="0" style="max-width:100%;" src="'+C.image+'"/>':null==C.desc&&(R.style.padding="20px",R.style.color="rgb(179, 179, 179)",mxUtils.write(R,mxResources.get("noPreview")));null!=J&&(J.style.backgroundColor="");J=D;J.style.backgroundColor=Editor.isDarkMode()?"#000000":"#ebf2f9";null!=O&&mxEvent.consume(O)}};