Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
PageSetupDialog.addPageFormatPanel=function(b,e,g,n){function y(O,H,ja){if(ja||R!=document.activeElement&&V!=document.activeElement){O=!1;for(H=0;H<f.length;H++)ja=f[H],B?"custom"==ja.key&&(K.value=ja.key,B=!1):null!=ja.format&&("a4"==ja.key?826==g.width?(g=mxRectangle.fromRectangle(g),g.width=827):826==g.height&&(g=mxRectangle.fromRectangle(g),g.height=827):"a5"==ja.key&&(584==g.width?(g=mxRectangle.fromRectangle(g),g.width=583):584==g.height&&(g=mxRectangle.fromRectangle(g),g.height=583)),g.width==
ja.format.width&&g.height==ja.format.height?(K.value=ja.key,q.setAttribute("checked","checked"),q.defaultChecked=!0,q.checked=!0,E.removeAttribute("checked"),E.defaultChecked=!1,E.checked=!1,O=!0):g.width==ja.format.height&&g.height==ja.format.width&&(K.value=ja.key,q.removeAttribute("checked"),q.defaultChecked=!1,q.checked=!1,E.setAttribute("checked","checked"),E.defaultChecked=!0,O=E.checked=!0));O?(S.style.display="",L.style.display="none"):(R.value=g.width/100,V.value=g.height/100,q.setAttribute("checked",
"checked"),K.value="custom",S.style.display="none",L.style.display="")}}e="format-"+e;var q=document.createElement("input");q.setAttribute("name",e);q.setAttribute("type","radio");q.setAttribute("value","portrait");var E=document.createElement("input");E.setAttribute("name",e);E.setAttribute("type","radio");E.setAttribute("value","landscape");var K=document.createElement("select");K.style.marginBottom="8px";K.style.borderRadius="4px";K.style.borderWidth="1px";K.style.borderStyle="solid";K.style.width=