Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
PageSetupDialog.addPageFormatPanel=function(b,e,g,n){function y(O,G,ja){if(ja||R!=document.activeElement&&W!=document.activeElement){O=!1;for(G=0;G<f.length;G++)ja=f[G],A?"custom"==ja.key&&(N.value=ja.key,A=!1):null!=ja.format&&("a4"==ja.key?826==g.width?(g=mxRectangle.fromRectangle(g),g.width=827):826==g.height&&(g=mxRectangle.fromRectangle(g),g.height=827):"a5"==ja.key&&(584==g.width?(g=mxRectangle.fromRectangle(g),g.width=583):584==g.height&&(g=mxRectangle.fromRectangle(g),g.height=583)),g.width==
ja.format.width&&g.height==ja.format.height?(N.value=ja.key,q.setAttribute("checked","checked"),q.defaultChecked=!0,q.checked=!0,E.removeAttribute("checked"),E.defaultChecked=!1,E.checked=!1,O=!0):g.width==ja.format.height&&g.height==ja.format.width&&(N.value=ja.key,q.removeAttribute("checked"),q.defaultChecked=!1,q.checked=!1,E.setAttribute("checked","checked"),E.defaultChecked=!0,O=E.checked=!0));O?(T.style.display="",K.style.display="none"):(R.value=g.width/100,W.value=g.height/100,q.setAttribute("checked",
"checked"),N.value="custom",T.style.display="none",K.style.display="")}}e="format-"+e;var q=document.createElement("input");q.setAttribute("name",e);q.setAttribute("type","radio");q.setAttribute("value","portrait");var E=document.createElement("input");E.setAttribute("name",e);E.setAttribute("type","radio");E.setAttribute("value","landscape");var N=document.createElement("select");N.style.marginBottom="8px";N.style.borderRadius="4px";N.style.borderWidth="1px";N.style.borderStyle="solid";N.style.width=