Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z.setAttribute("value",v.key);mxUtils.write(z,v.title);N.appendChild(z)}var A=!1;y();b.appendChild(N);mxUtils.br(b);b.appendChild(T);b.appendChild(K);var H=g,J=function(O,G){O=d[N.value];null!=O.format?(R.value=O.format.width/100,W.value=O.format.height/100,K.style.display="none",T.style.display=""):(T.style.display="none",K.style.display="");O=parseFloat(R.value);if(isNaN(O)||0>=O)R.value=g.width/100;O=parseFloat(W.value);if(isNaN(O)||0>=O)W.value=g.height/100;O=new mxRectangle(0,0,Math.floor(100*
parseFloat(R.value)),Math.floor(100*parseFloat(W.value)));"custom"!=N.value&&E.checked&&(O=new mxRectangle(0,0,O.height,O.width));G&&A||O.width==H.width&&O.height==H.height||(H=O,null!=n&&n(H))};mxEvent.addListener(e,"click",function(O){q.checked=!0;J(O);mxEvent.consume(O)});mxEvent.addListener(F,"click",function(O){E.checked=!0;J(O);mxEvent.consume(O)});mxEvent.addListener(R,"blur",J);mxEvent.addListener(R,"click",J);mxEvent.addListener(W,"blur",J);mxEvent.addListener(W,"click",J);mxEvent.addListener(E,