Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G.setAttribute("type","range");G.setAttribute("min","2");G.setAttribute("max","30");G.setAttribute("value",D.freehand.getBrushSize());G.style.width="90%";G.style.visibility="hidden";F.appendChild(G);mxUtils.br(F);M=function(){D.freehand.setPerfectFreehandMode(K.checked);G.style.visibility=K.checked?"visible":"hidden"};mxEvent.addListener(K,"change",M);M();mxEvent.addListener(G,"change",function(){D.freehand.setBrushSize(parseInt(this.value))})}var S=mxUtils.button(mxResources.get("startDrawing"),