Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e.appendChild(M);e.appendChild(f);z.appendChild(e);var I=y,d,g,n=function(A,H,L,F){var S="data:"==A.substring(0,5);!b.isOffline()||S&&"undefined"===typeof chrome?0<A.length&&b.spinner.spin(document.body,mxResources.get("inserting"))?b.loadImage(A,function(p){b.spinner.stop();b.hideDialog();var q=!1===F?1:null!=H&&null!=L?Math.max(H/p.width,L/p.height):Math.min(1,Math.min(520/p.width,520/p.height));l&&(A=b.convertDataUri(A));c(A,Math.round(Number(p.width)*q),Math.round(Number(p.height)*q),I,d,g)},
function(){b.spinner.stop();c(null);b.showError(mxResources.get("error"),mxResources.get("fileNotFound"),mxResources.get("ok"))}):(b.hideDialog(),c(A,null,null,I,d,g)):(A=b.convertDataUri(A),H=null==H?120:H,L=null==L?100:L,b.hideDialog(),c(A,H,L,I,d,g))},t=function(A,H){if(null!=A){var L=k?null:D.getModel().getGeometry(D.getSelectionCell());null!=L?n(A,L.width,L.height,H):n(A,null,null,H)}else b.hideDialog(),c(null)};this.init=function(){M.focus();if(Graph.fileSupport){M.setAttribute("placeholder",