Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
v.setAttribute("disabled","disabled")}));mxUtils.br(d);return{getLink:function(){return n.checked?"blank"===v.value?"_blank":u:null},getEditInput:function(){return n},getEditSelect:function(){return v}}};EditorUi.prototype.addLinkSection=function(d,g){function n(){var H=document.createElement("div");H.style.width="100%";H.style.height="100%";H.style.boxSizing="border-box";null!=v&&v!=mxConstants.NONE?(H.style.border="1px solid black",H.style.backgroundColor=v):(H.style.backgroundPosition="center center",
H.style.backgroundRepeat="no-repeat",H.style.backgroundImage="url('"+Dialog.prototype.closeImage+"')");A.innerText="";A.appendChild(H)}mxUtils.write(d,mxResources.get("links")+":");var t=document.createElement("select");t.style.width="100px";t.style.padding="0px";t.style.marginLeft="8px";t.style.marginRight="10px";t.className="geBtn";var u=document.createElement("option");u.setAttribute("value","auto");mxUtils.write(u,mxResources.get("automatic"));t.appendChild(u);u=document.createElement("option");
u.setAttribute("value","blank");mxUtils.write(u,mxResources.get("openInNewWindow"));t.appendChild(u);u=document.createElement("option");u.setAttribute("value","self");mxUtils.write(u,mxResources.get("openInThisWindow"));t.appendChild(u);g&&(g=document.createElement("option"),g.setAttribute("value","frame"),mxUtils.write(g,mxResources.get("openInThisWindow")+" ("+mxResources.get("iframe")+")"),t.appendChild(g));d.appendChild(t);mxUtils.write(d,mxResources.get("borderColor")+":");var v="#0000ff",A=
null;A=mxUtils.button("",mxUtils.bind(this,function(H){this.pickColor(v||"none",function(L){v=L;n()});mxEvent.consume(H)}));n();A.style.padding=mxClient.IS_FF?"4px 2px 4px 2px":"4px";A.style.marginLeft="4px";A.style.height="22px";A.style.width="22px";A.style.position="relative";A.style.top=mxClient.IS_IE||mxClient.IS_IE11||mxClient.IS_EDGE?"6px":"1px";A.className="geColorBtn";d.appendChild(A);mxUtils.br(d);return{getColor:function(){return v},getTarget:function(){return t.value},focus:function(){t.focus()}}};