Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
}finally{e.getModel().endUpdate()}t&&(e.setSelectionCell(g),e.scrollCellToVisible(g))}};m=mxUtils.button(mxResources.get("preview"),function(){c(H,R,!1)});m.className="geBtn";L.appendChild(m);m=mxUtils.button(mxResources.get("apply"),function(){c(b.editor.graph,f,!0)});m.className="geBtn gePrimaryBtn";L.appendChild(m);b.editor.cancelFirst||L.appendChild(u);F.appendChild(L);E.appendChild(F);v.appendChild(E);this.container=v},CustomDialog=function(b,f,m,d,u,v,E,F,L,N,H,R){var J=document.createElement("div");
J.appendChild(f);var c=document.createElement("div");c.style.marginTop=null!=R?R:"30px";c.style.textAlign="center";null!=E&&c.appendChild(E);b.isOffline()||null==v||(f=mxUtils.button(mxResources.get("help"),function(){b.openLink(v)}),f.className="geBtn",c.appendChild(f));L=mxUtils.button(L||mxResources.get("cancel"),function(){b.hideDialog();null!=d&&d()});L.className="geBtn";F&&(L.style.display="none");b.editor.cancelFirst&&c.appendChild(L);u=mxUtils.button(u||mxResources.get("ok"),mxUtils.bind(this,
function(){N||b.hideDialog(null,null,this.container);if(null!=m){var e=m();if("string"===typeof e){b.showError(mxResources.get("error"),e);return}}N&&b.hideDialog(null,null,this.container)}));c.appendChild(u);u.className="geBtn gePrimaryBtn";b.editor.cancelFirst||c.appendChild(L);if(null!=H)for(F=0;F<H.length;F++)(function(e,g,q){e=mxUtils.button(e,function(p){g(p)});null!=q&&e.setAttribute("title",q);e.className="geBtn";c.appendChild(e)})(H[F][0],H[F][1],H[F][2]);J.appendChild(c);this.cancelBtn=
L;this.okButton=u;this.container=J},TemplatesDialog=function(b,f,m,d,u,v,E,F,L,N,H,R,J,c,e){function g(ia){wa.innerText=ia;wa.style.display="block";setTimeout(function(){wa.style.display="none"},4E3)}function q(){null!=y&&(y.style.fontWeight="normal",y.style.textDecoration="none",G=y,y=null)}function p(ia,aa,la,ma,oa,fa,ja){if(-1<ia.className.indexOf("geTempDlgRadioBtnActive"))return!1;ia.className+=" geTempDlgRadioBtnActive";O.querySelector(".geTempDlgRadioBtn[data-id="+ma+"]").className="geTempDlgRadioBtn "+