Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
X||(ca.style.backgroundImage="url("+mxWindow.prototype.normalizeImage+")",ca.style.backgroundPosition="right 6px center",ca.style.backgroundRepeat="no-repeat",ca.style.paddingRight="22px");return ca}function d(V,X,Y,Z,ca,da){var ma=document.createElement("a");ma.className="geMenuItem";ma.style.display="inline-block";ma.style.boxSizing="border-box";ma.style.height="30px";ma.style.padding="6px";ma.style.position="relative";ma.style.verticalAlign="top";ma.style.top="0px";null!=v.statusContainer?H.insertBefore(ma,
v.statusContainer):H.appendChild(ma);null!=da?(ma.style.backgroundImage="url("+da+")",ma.style.backgroundPosition="center center",ma.style.backgroundRepeat="no-repeat",ma.style.backgroundSize="24px 24px",ma.style.width="34px"):mxUtils.write(ma,V);mxEvent.addListener(ma,mxClient.IS_POINTER?"pointerdown":"mousedown",mxUtils.bind(this,function(ea){ea.preventDefault()}));mxEvent.addListener(ma,"click",function(ea){"disabled"!=ma.getAttribute("disabled")&&X(ea);mxEvent.consume(ea)});null==Y&&(ma.style.marginRight=
"4px");null!=Z&&ma.setAttribute("title",Z);null!=ca&&(V=function(){ca.isEnabled()?(ma.removeAttribute("disabled"),ma.style.cursor="pointer"):(ma.setAttribute("disabled","disabled"),ma.style.cursor="default")},ca.addListener("stateChanged",V),A.addListener("enabledChanged",V),V());return ma}function g(V,X,Y){Y=document.createElement("div");Y.className="geMenuItem";Y.style.display="inline-block";Y.style.verticalAlign="top";Y.style.marginRight="6px";Y.style.padding="0 4px 0 4px";Y.style.height="30px";