Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.updateTabContainer=function(){if(null!=this.tabContainer&&null!=this.pages){var b=this.editor.graph,f=document.createElement("div");f.className="geTabScroller";for(var m=null,d=0;d<this.pages.length;d++)mxUtils.bind(this,function(u,v){v.className=this.pages[u]==this.currentPage?"geTab gePageTab geActivePage":"geTab gePageTab geInactivePage";v.setAttribute("draggable","true");mxEvent.addListener(v,"dragstart",mxUtils.bind(this,function(E){b.isEnabled()?(mxClient.IS_FF&&E.dataTransfer.setData("Text",
"<diagram/>"),m=u):mxEvent.consume(E)}));mxEvent.addListener(v,"dragend",mxUtils.bind(this,function(E){m=null;E.stopPropagation();E.preventDefault()}));mxEvent.addListener(v,"dragover",mxUtils.bind(this,function(E){null!=m&&(E.dataTransfer.dropEffect="move");E.stopPropagation();E.preventDefault()}));mxEvent.addListener(v,"drop",mxUtils.bind(this,function(E){null!=m&&u!=m&&this.movePage(m,u);E.stopPropagation();E.preventDefault()}));f.appendChild(v)})(d,this.createTabForPage(this.pages[d],d+1));d=
null!=this.tabScroller?this.tabScroller.scrollLeft:0;this.tabContainer.innerText="";"simple"!=Editor.currentTheme&&(this.pageMenuTab=this.createPageMenuTab(),this.tabContainer.appendChild(this.pageMenuTab));this.tabContainer.appendChild(f);this.isPageInsertTabVisible()&&this.tabContainer.appendChild(this.createPageInsertTab());this.leftScrollTab=this.createLeftScrollTab();this.tabContainer.appendChild(this.leftScrollTab);this.rightScrollTab=this.createRightScrollTab();this.tabContainer.appendChild(this.rightScrollTab);
this.tabScroller=f;this.tabScroller.scrollLeft=d;this.checkTabScrollerOverflow();mxEvent.addListener(this.tabScroller,"scroll",mxUtils.bind(this,function(u){this.checkTabScrollerOverflow()}));window.setTimeout(mxUtils.bind(this,function(){mxUtils.setPrefixedStyle(this.leftScrollTab.style,"transition","all 0.2s linear");mxUtils.setPrefixedStyle(this.rightScrollTab.style,"transition","all 0.2s linear")}),0)}};