Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=f&&f();b.openLink(e,null,!0)});y.className="geBtn gePrimaryBtn";y.style.width=x.style.width;l.appendChild(y);mxUtils.br(l);mxUtils.br(l);mxUtils.write(l,mxResources.get("allowPopups"));this.container=l},ImageDialog=function(b,e,f,c,k,l,x,y){function E(){0<M.value.length?v.removeAttribute("disabled"):v.setAttribute("disabled","disabled")}l=null!=l?l:!0;var D=b.editor.graph,z=document.createElement("div");mxUtils.write(z,e);e=document.createElement("div");e.className="geTitle";e.style.backgroundColor=