Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var PageSetupDialog=function(b){function e(){var k=R;null!=k&&null!=k.originalSrc&&(k=b.createImageForPageLink(k.originalSrc,null));null!=k&&null!=k.src?(K.style.backgroundImage="url("+k.src+")",K.style.display="inline-block"):(K.style.backgroundImage="",K.style.display="none");K.style.backgroundColor="";null!=W&&W!=mxConstants.NONE&&(K.style.backgroundColor=W,K.style.display="inline-block")}var g=b.editor.graph,n=document.createElement("table");n.style.width="100%";n.style.height="100%";var y=document.createElement("tbody");