Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"geBtn gePrimaryBtn";var m=document.createElement("img");m.setAttribute("src",Sidebar.prototype.searchImage);m.setAttribute("title",mxResources.get("preview"));m.className="geActiveButton";m.style.position="absolute";m.style.cursor="default";m.style.padding="8px";m.style.right="0px";m.style.top="0px";var B=!1,K=null,R=!1;if(M||I){var U=[],W=null,Q=null,V=null,X=function(aa){T.setAttribute("disabled","disabled");for(var la=0;la<U.length;la++)U[la].className=la==aa?"geBtn gePrimaryBtn":"geBtn"};J=!0;