Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var StorageDialog=function(b,e,f){function c(M,I,d,g,n,t){function u(){mxEvent.addListener(v,"click",null!=t?t:function(){d==App.MODE_GOOGLE&&b.spinner.spin(document.body,mxResources.get("authorizing"))?b.drive.checkToken(mxUtils.bind(this,function(){b.spinner.stop();b.setMode(d,!0);e()})):d==App.MODE_ONEDRIVE&&b.spinner.spin(document.body,mxResources.get("authorizing"))?b.oneDrive.checkToken(mxUtils.bind(this,function(){b.spinner.stop();b.setMode(d,!0);e()}),function(S){b.spinner.stop();b.handleError(S)}):
(b.setMode(d,!0),e())})}y++;++x>f&&(mxUtils.br(E),x=1);var v=document.createElement("a");v.style.overflow="hidden";v.style.display="inline-block";v.className="geBaseButton";v.style.boxSizing="border-box";v.style.fontSize="11px";v.style.position="relative";v.style.margin="4px";v.style.marginTop="8px";v.style.marginBottom="0px";v.style.padding="8px 10px 8px 10px";v.style.width="88px";v.style.height="100px";v.style.whiteSpace="nowrap";v.setAttribute("title",I);var A=document.createElement("div");A.style.textOverflow=