Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p);this.handleError(d,g,n,t,u)}),S,mxResources.get("changeUser"),mxUtils.bind(this,function(){function C(){O.innerText="";for(var N=0;N<J.length;N++){var T=document.createElement("option");mxUtils.write(T,J[N].displayName);T.value=N;O.appendChild(T);T=document.createElement("option");T.innerHTML="&nbsp;&nbsp;&nbsp;";mxUtils.write(T,"<"+J[N].email+">");T.setAttribute("disabled","disabled");O.appendChild(T)}T=document.createElement("option");mxUtils.write(T,mxResources.get("addAccount"));T.value=J.length;
O.appendChild(T)}var J=this.drive.getUsersList(),G=document.createElement("div"),P=document.createElement("span");P.style.marginTop="6px";mxUtils.write(P,mxResources.get("changeUser")+": ");G.appendChild(P);var O=document.createElement("select");O.style.width="200px";C();mxEvent.addListener(O,"change",mxUtils.bind(this,function(){var N=O.value,T=J.length!=N;T&&this.drive.setUser(J[N]);this.drive.authorize(T,mxUtils.bind(this,function(){T||(J=this.drive.getUsersList(),C())}),mxUtils.bind(this,function(m){this.handleError(m)}),