Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
B.appendChild(C);var J=document.createElement("div");J.style.marginTop="10px";if(l){var F=function(R,m,A,M,Q){if(null==Q||"1"!=Q.html)return M=R.toLowerCase().indexOf(m,M),0>M?R:R.substr(0,M)+A+R.substr(M+m.length);var U=R;m=mxUtils.htmlEntities(m);Q=[];var W=-1;for(R=R.replace(/<br>/ig,"\n");-1<(W=R.indexOf("<",W+1));)Q.push(W);W=R.match(/<[^>]*>/g);R=R.replace(/<[^>]*>/g,"");M=R.toLowerCase().indexOf(m,M);if(0>M)return U;U=M+m.length;A=mxUtils.htmlEntities(A);R=R.substr(0,M)+A+R.substr(U);for(var P=
0,V=0;V<Q.length;V++){if(Q[V]-P<M)R=R.substr(0,Q[V])+W[V]+R.substr(Q[V]);else{var X=Q[V]-P<U?M+P:Q[V]+(A.length-m.length);R=R.substr(0,X)+W[V]+R.substr(X)}P+=W[V].length}return R.replace(/\n/g,"<br>")},O=mxUtils.button(mxResources.get("replFind"),function(){try{if(null!=n&&null!=I){var R=I.cell,m=z.getLabel(R);z.isCellEditable(R)&&z.model.setValue(R,F(m,n,L.value,t-n.length,z.getCurrentCellStyle(R)));H.style.backgroundColor=E(!1,!0)?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}}catch(A){b.handleError(A)}});