Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var PopupDialog=function(b,e,f,c,k){k=null!=k?k:!0;var l=document.createElement("div");l.style.textAlign="left";l.style.height="100%";mxUtils.write(l,mxResources.get("fileOpenLocation"));mxUtils.br(l);mxUtils.br(l);var x=mxUtils.button(mxResources.get("openInThisWindow"),function(){k&&b.hideDialog();null!=c&&c()});x.className="geBtn";x.style.marginBottom="8px";x.style.width="280px";l.appendChild(x);mxUtils.br(l);var y=mxUtils.button(mxResources.get("openInNewWindow"),function(){k&&b.hideDialog();
null!=f&&f();b.openLink(e,null,!0)});y.className="geBtn gePrimaryBtn";y.style.width=x.style.width;l.appendChild(y);mxUtils.br(l);mxUtils.br(l);mxUtils.write(l,mxResources.get("allowPopups"));this.container=l},ImageDialog=function(b,e,f,c,k,l,x,y){function E(){0<M.value.length?v.removeAttribute("disabled"):v.setAttribute("disabled","disabled")}l=null!=l?l:!0;var D=b.editor.graph,z=document.createElement("div");mxUtils.write(z,e);e=document.createElement("div");e.className="geTitle";e.style.backgroundColor=