Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.appendChild(v);this.pagesContainer=m;this.layersContainer=v;this.ui=b;m=document.createElement("div");m.style.marginTop="16px";m.style.textAlign="center";v=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog();null!=u&&u()});v.className="geBtn";b.editor.cancelFirst&&m.appendChild(v);var E=mxUtils.button(mxResources.get("ok"),mxUtils.bind(this,function(){b.hideDialog();d({pageId:this.selectedPage,layerIds:Object.keys(this.selectedLayers)})}));m.appendChild(E);E.className="geBtn gePrimaryBtn";