Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(ka?"geTempDlgRadioBtnLarge":"geTempDlgRadioBtnSmall");N.querySelector("."+aa).src="/images/"+la+"-sel.svg";N.querySelector("."+pa).src="/images/"+ha+".svg";return!0}function v(ja,aa,la,na){function pa(wa,Ma){null==ka?(wa=/^https?:\/\//.test(wa)&&!b.editor.isCorsEnabledForUrl(wa)?PROXY_URL+"?url="+encodeURIComponent(wa):TEMPLATE_PATH+"/"+wa,mxUtils.get(wa,mxUtils.bind(this,function(Ia){200<=Ia.getStatus()&&299>=Ia.getStatus()&&(ka=Ia.getText());Ma(ka)}))):Ma(ka)}function ha(wa,Ma,Ia){if(null!=wa&&
mxUtils.isAncestorNode(document.body,aa)&&(wa=mxUtils.parseXml(wa),wa=Editor.extractGraphModel(wa.documentElement,!0),null!=wa)){"mxfile"==wa.nodeName&&(wa=Editor.parseDiagramNode(wa.getElementsByTagName("diagram")[0]));var Aa=new mxCodec(wa.ownerDocument),Ja=new mxGraphModel;Aa.decode(wa,Ja);wa=Ja.root.getChildAt(0).children||[];b.sidebar.createTooltip(aa,wa,Math.min((window.innerWidth||document.documentElement.clientWidth||document.body.clientWidth)-80,1E3),Math.min((window.innerHeight||document.documentElement.clientHeight||
document.body.clientHeight)-80,800),null!=ja.title?mxResources.get(ja.title,null,ja.title):null,!0,new mxPoint(Ma,Ia),!0,null,!0);var Na=document.createElement("div");Na.className="geTempDlgDialogMask";N.appendChild(Na);var ra=b.sidebar.hideTooltip;b.sidebar.hideTooltip=function(){Na&&(N.removeChild(Na),Na=null,ra.apply(this,arguments),b.sidebar.hideTooltip=ra)};mxEvent.addListener(Na,"click",function(){b.sidebar.hideTooltip()})}}var ka=null;if(oa||b.sidebar.currentElt==aa)b.sidebar.hideTooltip();