Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.addTabListeners=function(b,f){mxEvent.disableContextMenu(f);var m=this.editor.graph;mxEvent.addListener(f,"dblclick",mxUtils.bind(this,function(K){this.renamePage(b);mxEvent.consume(K)}));var d=document.createElement("div");d.className="geTabMenuButton";d.style.backgroundImage="url("+mxWindow.prototype.minimizeImage+")";d.style.backgroundPosition="center center";d.style.backgroundRepeat="no-repeat";d.style.backgroundSize="10px";f.appendChild(d);var u=!1,v=!1,D=mxUtils.bind(this,
function(K){u=null!=this.currentMenu;v=b==this.currentPage;m.isMouseDown||v||this.selectPage(b);this.scrollToPage()}),F=mxUtils.bind(this,function(K){if(m.isEnabled()&&!m.isMouseDown&&(v&&(mxEvent.isTouchEvent(K)||mxEvent.getSource(K)==d)||mxEvent.isPopupTrigger(K))&&(m.popupMenuHandler.hideMenu(),this.hideCurrentMenu(),!mxEvent.isTouchEvent(K)||!u)){var M=new mxPopupMenu(this.createPageMenu(b));M.div.className+=" geMenubarMenu";M.smartSeparators=!0;M.showDisabled=!0;M.autoExpand=!0;M.hideMenu=mxUtils.bind(this,
function(){mxPopupMenu.prototype.hideMenu.apply(M,arguments);this.resetCurrentMenu();M.destroy()});var G=mxEvent.getClientX(K),S=mxEvent.getClientY(K);M.popup(G,S,null,K);this.setCurrentMenu(M,f)}mxEvent.consume(K)});mxEvent.addGestureListeners(d,D,null,F);mxEvent.addGestureListeners(f,D,null,F)};