Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"geBtn gePrimaryBtn";var k=document.createElement("img");k.setAttribute("src",Sidebar.prototype.searchImage);k.setAttribute("title",mxResources.get("preview"));k.className="geActiveButton";k.style.position="absolute";k.style.cursor="default";k.style.padding="8px";k.style.right="0px";k.style.top="0px";var y=!1,G=null,P=!1;if(R||J){var Q=[],U=null,T=null,W=null,X=function(aa){V.setAttribute("disabled","disabled");for(var la=0;la<Q.length;la++)Q[la].className=la==aa?"geBtn gePrimaryBtn":"geBtn"};C=!0;