Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
PrintDialog.prototype.create=function(b){function e(d){var f=E.checked||G.checked,l=parseInt(R.value)/100;isNaN(l)&&(l=1,R.value="100%");mxClient.IS_SF&&(l*=.75);var u=g.pageFormat||mxConstants.PAGE_FORMAT_A4_PORTRAIT,A=1/g.pageScale;if(f){var B=E.checked?1:parseInt(L.value);isNaN(B)||(A=mxUtils.getScaleForPageCount(B,g,u))}var F=B=0;u=mxRectangle.fromRectangle(u);u.width=Math.ceil(u.width*l);u.height=Math.ceil(u.height*l);A*=l;!f&&g.pageVisible?(l=g.getPageLayout(),B-=l.x*u.width,F-=l.y*u.height):
f=!0;f=PrintDialog.createPrintPreview(g,A,u,0,B,F,f);f.open();d&&PrintDialog.printPreview(f)}var g=b.editor.graph,n=document.createElement("table");n.style.width="100%";n.style.height="100%";var y=document.createElement("tbody");var q=document.createElement("tr");var E=document.createElement("input");E.setAttribute("type","checkbox");var K=document.createElement("td");K.setAttribute("colspan","2");K.style.fontSize="10pt";K.appendChild(E);var S=document.createElement("span");mxUtils.write(S," "+mxResources.get("fitPage"));