Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A.setAttribute("value",u.key);mxUtils.write(A,u.title);K.appendChild(A)}var B=!1;y();b.appendChild(K);mxUtils.br(b);b.appendChild(S);b.appendChild(L);var F=g,M=function(O,H){O=d[K.value];null!=O.format?(R.value=O.format.width/100,V.value=O.format.height/100,L.style.display="none",S.style.display=""):(S.style.display="none",L.style.display="");O=parseFloat(R.value);if(isNaN(O)||0>=O)R.value=g.width/100;O=parseFloat(V.value);if(isNaN(O)||0>=O)V.value=g.height/100;O=new mxRectangle(0,0,Math.floor(100*
parseFloat(R.value)),Math.floor(100*parseFloat(V.value)));"custom"!=K.value&&E.checked&&(O=new mxRectangle(0,0,O.height,O.width));H&&B||O.width==F.width&&O.height==F.height||(F=O,null!=n&&n(F))};mxEvent.addListener(e,"click",function(O){q.checked=!0;M(O);mxEvent.consume(O)});mxEvent.addListener(G,"click",function(O){E.checked=!0;M(O);mxEvent.consume(O)});mxEvent.addListener(R,"blur",M);mxEvent.addListener(R,"click",M);mxEvent.addListener(V,"blur",M);mxEvent.addListener(V,"click",M);mxEvent.addListener(E,