Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A.setAttribute("value",e||"");A.style.marginLeft="4px";A.style.width=null!=R?R+"px":"180px";var B=mxUtils.button(g,function(){if(null==q||q(A.value))S&&b.hideDialog(),n(A.value)});B.className="geBtn gePrimaryBtn";this.init=function(){if(null!=y||null==E)if(null!=L?Editor.selectFilename(A):(A.focus(),mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?A.select():document.execCommand("selectAll",!1,null)),Graph.fileSupport){var F=d.parentNode;if(null!=F){var M=null;mxEvent.addListener(F,"dragleave",
function(O){null!=M&&(M.style.backgroundColor="",M=null);O.stopPropagation();O.preventDefault()});mxEvent.addListener(F,"dragover",mxUtils.bind(this,function(O){null==M&&(!mxClient.IS_IE||10<document.documentMode)&&(M=A,M.style.backgroundColor="#ebf2f9");O.stopPropagation();O.preventDefault()}));mxEvent.addListener(F,"drop",mxUtils.bind(this,function(O){null!=M&&(M.style.backgroundColor="",M=null);0<=mxUtils.indexOf(O.dataTransfer.types,"text/uri-list")&&(A.value=decodeURIComponent(O.dataTransfer.getData("text/uri-list")),
B.click());O.stopPropagation();O.preventDefault()}))}}};u=document.createElement("td");u.style.whiteSpace="nowrap";u.appendChild(A);l.appendChild(u);if(null!=y||null==E)f.appendChild(l),null!=L&&(u.appendChild(FilenameDialog.createTypeHint(b,A,L)),null!=b.editor.diagramFileTypes&&(l=document.createElement("tr"),u=document.createElement("td"),u.style.textOverflow="ellipsis",u.style.textAlign="right",u.style.maxWidth="100px",u.style.fontSize="10pt",u.style.width="84px",mxUtils.write(u,mxResources.get("type")+