Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=c)m||b.hideDialog(),c(za,Ba,M.value);else if(d)m||b.hideDialog(),d(na,M.value,Ca,ca);else{var aa=M.value;null!=aa&&0<aa.length&&b.pickFolder(b.mode,function(la){b.createFile(aa,na,null!=ca&&0<ca.length?ca:null,null,function(){b.hideDialog()},null,la,null,null!=ha&&0<ha.length?ha:null)},b.mode!=App.MODE_GOOGLE||null==b.stateArg||null==b.stateArg.folderId)}}function A(aa,la,ma,oa,fa,ja,sa){null!=ea&&(ea.style.backgroundColor="transparent",ea.style.border="1px solid transparent");V.removeAttribute("disabled");
na=la;ca=ma;ha=ja;ea=aa;za=oa;Ca=sa;Ba=fa;ea.style.backgroundColor=F;ea.style.border=L}function S(aa,la,ma,oa,fa,ja,sa,ta,La,Ga,ya){function Ja(Na,Ya){null==Fa?(Ka=Na,Ka=/^https?:\/\//.test(Ka)&&!b.editor.isCorsEnabledForUrl(Ka)?PROXY_URL+"?url="+encodeURIComponent(Ka):TEMPLATE_PATH+"/"+Ka,mxUtils.get(Ka,mxUtils.bind(this,function(Wa){200<=Wa.getStatus()&&299>=Wa.getStatus()&&(Fa=Wa.getText());Ya(Fa,Ka)}))):Ya(Fa,Ka)}function Ma(Na,Ya){if(null==aa||y||b.sidebar.currentElt==ra)b.sidebar.hideTooltip();