Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	rename(id = null) {
		var _this = this;

		var settings = {
			title: 'Rename',
			params: [
				{name: "name", title: "Name:", value: config.layer.name},
			],
			on_load: function () {
				document.querySelector('#pop_data_name').select();
			},
			on_finish: function (params) {
				app.State.do_action(
					new app.Actions.Bundle_action('rename_layer', 'Rename Layer', [
						new app.Actions.Refresh_layers_gui_action('undo'),
						new app.Actions.Update_layer_action(id || config.layer.id, {
							name: params.name
						}),
						new app.Actions.Refresh_layers_gui_action('do')
					])
				);
			},
		};
		this.POP.show(settings);
	}