Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d[S].apply(this,arguments);null!=p&&F.push(p)}b.sidebar.showEntries(0<F.length?F.join(";"):"",t.checked);b.hideDialog()});E.className="geBtn gePrimaryBtn";f=document.createElement("div");f.style.marginTop="26px";f.style.textAlign="right"}b.editor.cancelFirst?(f.appendChild(l),f.appendChild(E)):(f.appendChild(E),f.appendChild(l));c.appendChild(f);this.container=c},PluginsDialog=function(b,e,f,c){function k(){E=!0;if(0==y.length)x.innerText=mxResources.get("noPlugins");else{x.innerText="";for(var g=
0;g<y.length;g++){var n=document.createElement("span");n.style.whiteSpace="nowrap";var t=document.createElement("span");t.className="geSprite geSprite-delete";t.style.position="relative";t.style.cursor="pointer";t.style.top="5px";t.style.marginRight="4px";t.style.display="inline-block";n.appendChild(t);mxUtils.write(n,y[g]);x.appendChild(n);mxUtils.br(x);mxEvent.addListener(t,"click",function(u){return function(){b.confirm(mxResources.get("delete")+' "'+y[u]+'"?',function(){null!=f&&f(y[u]);y.splice(u,
1);k()})}}(g))}}}var l=document.createElement("div"),x=document.createElement("div");x.style.height="180px";x.style.overflow="auto";var y=mxSettings.getPlugins().slice(),E=!1;l.appendChild(x);k();E=!1;var D=mxUtils.button(mxResources.get("add"),null!=e?function(){e(function(g){g&&0>mxUtils.indexOf(y,g)&&y.push(g);k()})}:function(){var g=document.createElement("div"),n=document.createElement("span");n.style.marginTop="6px";mxUtils.write(n,mxResources.get("builtinPlugins")+": ");g.appendChild(n);var t=