Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
}finally{g.getModel().endUpdate()}v&&(g.setSelectionCell(n),g.scrollCellToVisible(n))}};f=mxUtils.button(mxResources.get("preview"),function(){d(z,M,!1)});f.className="geBtn";E.appendChild(f);f=mxUtils.button(mxResources.get("apply"),function(){d(b.editor.graph,e,!0)});f.className="geBtn gePrimaryBtn";E.appendChild(f);b.editor.cancelFirst||E.appendChild(k);y.appendChild(E);x.appendChild(y);l.appendChild(x);this.container=l},CustomDialog=function(b,e,f,c,k,l,x,y,E,D,z,M){var I=document.createElement("div");
I.appendChild(e);var d=document.createElement("div");d.style.marginTop=null!=M?M:"30px";d.style.textAlign="center";null!=x&&d.appendChild(x);b.isOffline()||null==l||(e=mxUtils.button(mxResources.get("help"),function(){b.openLink(l)}),e.className="geBtn",d.appendChild(e));E=mxUtils.button(E||mxResources.get("cancel"),function(){b.hideDialog();null!=c&&c()});E.className="geBtn";y&&(E.style.display="none");b.editor.cancelFirst&&d.appendChild(E);k=mxUtils.button(k||mxResources.get("ok"),mxUtils.bind(this,
function(){D||b.hideDialog(null,null,this.container);if(null!=f){var g=f();if("string"===typeof g){b.showError(mxResources.get("error"),g);return}}D&&b.hideDialog(null,null,this.container)}));d.appendChild(k);k.className="geBtn gePrimaryBtn";b.editor.cancelFirst||d.appendChild(E);if(null!=z)for(y=0;y<z.length;y++)(function(g,n,t){g=mxUtils.button(g,function(u){n(u)});null!=t&&g.setAttribute("title",t);g.className="geBtn";d.appendChild(g)})(z[y][0],z[y][1],z[y][2]);I.appendChild(d);this.cancelBtn=
E;this.okButton=k;this.container=I},TemplatesDialog=function(b,e,f,c,k,l,x,y,E,D,z,M,I,d,g){function n(ja){ta.innerText=ja;ta.style.display="block";setTimeout(function(){ta.style.display="none"},4E3)}function t(){null!=B&&(B.style.fontWeight="normal",B.style.textDecoration="none",K=B,B=null)}function u(ja,aa,la,na,pa,ha,ka){if(-1<ja.className.indexOf("geTempDlgRadioBtnActive"))return!1;ja.className+=" geTempDlgRadioBtnActive";N.querySelector(".geTempDlgRadioBtn[data-id="+na+"]").className="geTempDlgRadioBtn "+