Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.appendChild(f));D.appendChild(d);D.appendChild(g);this.container=D},FindWindow=function(b,e,f,c,k,l){function x(T,m,B,K){if("object"===typeof m.value&&null!=m.value.attributes){m=m.value.attributes;for(var R=0;R<m.length;R++)if("label"!=m[R].nodeName){var U=mxUtils.trim(m[R].nodeValue.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")).toLowerCase();if(null==T&&(K&&0<=U.indexOf(B)||!K&&U.substring(0,B.length)===B)||null!=T&&T.test(U))return!0}}return!1}function y(){d?(P.removeAttribute("disabled"),O.removeAttribute("disabled")):
(P.setAttribute("disabled","disabled"),O.setAttribute("disabled","disabled"));H.value?N.removeAttribute("disabled"):N.setAttribute("disabled","disabled")}function E(T,m,B){J.innerText="";var K=z.model.getDescendants(z.model.getRoot()),R=H.value.toLowerCase(),U=F.checked?new RegExp(R):null,W=null;n=null;M!=R&&(M=R,I=null,g=!1);var Q=null==I;if(0<R.length){if(g){g=!1;for(var V,X=0;X<b.pages.length;X++)if(b.currentPage==b.pages[X]){V=X;break}T=(V+1)%b.pages.length;I=null;do g=!1,K=b.pages[T],z=b.createTemporaryGraph(z.getStylesheet()),