Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.showImageDialog=function(b,e,g,n){n=this.editor.graph.cellEditor;var y=n.saveSelection(),q=mxUtils.prompt(b,e);n.restoreSelection(y);if(null!=q&&0<q.length){var E=new Image;E.onload=function(){g(q,E.width,E.height)};E.onerror=function(){g(null);mxUtils.alert(mxResources.get("fileNotFound"))};E.src=q}else g(null)};EditorUi.prototype.showLinkDialog=function(b,e,g){b=new LinkDialog(this,b,e,g);this.showDialog(b.container,420,90,!0,!0);b.init()};