Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A);ImageDialog.filePicked=function(G){G.action==google.picker.Action.PICKED&&null!=G.docs[0].thumbnails&&(G=G.docs[0].thumbnails[G.docs[0].thumbnails.length-1],null!=G&&(I.value=G.url,A()));I.focus()};y.appendChild(M);y.appendChild(d);mxUtils.br(y);mxUtils.br(y);D?(M.setAttribute("checked","checked"),M.checked=!0):(z.setAttribute("checked","checked"),z.checked=!0);!E&&M.checked&&(mxUtils.write(t,mxResources.get("pageNotFound")),t.setAttribute("disabled","disabled"),t.setAttribute("selected","selected"),