Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.write(l,f),l.setAttribute("for",F),d.appendChild(l),A||mxUtils.br(d));return O};EditorUi.prototype.addEditButton=function(d,f){var l=this.addCheckbox(d,mxResources.get("edit")+":",!0,null,!0);l.style.marginLeft="24px";var u=this.getCurrentFile(),A="";null!=u&&u.getMode()!=App.MODE_DEVICE&&u.getMode()!=App.MODE_BROWSER&&(A=window.location.href);var B=document.createElement("select");B.style.maxWidth="200px";B.style.width="auto";B.style.marginLeft="8px";B.style.marginRight="10px";B.className=
"geBtn";u=document.createElement("option");u.setAttribute("value","blank");mxUtils.write(u,mxResources.get("makeCopy"));B.appendChild(u);u=document.createElement("option");u.setAttribute("value","custom");mxUtils.write(u,mxResources.get("custom")+"...");B.appendChild(u);d.appendChild(B);mxEvent.addListener(B,"change",mxUtils.bind(this,function(){if("custom"==B.value){var F=new FilenameDialog(this,A,mxResources.get("ok"),function(M){null!=M?A=M:B.value="blank"},mxResources.get("url"),null,null,null,
null,function(){B.value="blank"});this.showDialog(F.container,300,80,!0,!1);F.init()}}));mxEvent.addListener(l,"change",mxUtils.bind(this,function(){l.checked&&(null==f||f.checked)?B.removeAttribute("disabled"):B.setAttribute("disabled","disabled")}));mxUtils.br(d);return{getLink:function(){return l.checked?"blank"===B.value?"_blank":A:null},getEditInput:function(){return l},getEditSelect:function(){return B}}};EditorUi.prototype.addLinkSection=function(d,f){function l(){var M=document.createElement("div");