Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.appendChild(m));N.appendChild(c);N.appendChild(e);this.container=N},FindWindow=function(b,f,m,d,u,v){function E(V,k,y,G){if("object"===typeof k.value&&null!=k.value.attributes){k=k.value.attributes;for(var P=0;P<k.length;P++)if("label"!=k[P].nodeName){var Q=mxUtils.trim(k[P].nodeValue.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")).toLowerCase();if(null==V&&(G&&0<=Q.indexOf(y)||!G&&Q.substring(0,y.length)===y)||null!=V&&V.test(Q))return!0}}return!1}function F(){c?(M.removeAttribute("disabled"),K.removeAttribute("disabled")):