Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l);this.handleError(c,e,g,q,p)}),S,mxResources.get("changeUser"),mxUtils.bind(this,function(){function z(){K.innerText="";for(var O=0;O<C.length;O++){var V=document.createElement("option");mxUtils.write(V,C[O].displayName);V.value=O;K.appendChild(V);V=document.createElement("option");V.innerHTML="&nbsp;&nbsp;&nbsp;";mxUtils.write(V,"<"+C[O].email+">");V.setAttribute("disabled","disabled");K.appendChild(V)}V=document.createElement("option");mxUtils.write(V,mxResources.get("addAccount"));V.value=C.length;
K.appendChild(V)}var C=this.drive.getUsersList(),D=document.createElement("div"),M=document.createElement("span");M.style.marginTop="6px";mxUtils.write(M,mxResources.get("changeUser")+": ");D.appendChild(M);var K=document.createElement("select");K.style.width="200px";z();mxEvent.addListener(K,"change",mxUtils.bind(this,function(){var O=K.value,V=C.length!=O;V&&this.drive.setUser(C[O]);this.drive.authorize(V,mxUtils.bind(this,function(){V||(C=this.drive.getUsersList(),z())}),mxUtils.bind(this,function(k){this.handleError(k)}),