Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.addTabListeners=function(b,f){mxEvent.disableContextMenu(f);var m=this.editor.graph;mxEvent.addListener(f,"dblclick",mxUtils.bind(this,function(L){this.renamePage(b);mxEvent.consume(L)}));var d=document.createElement("div");d.className="geTabMenuButton";d.style.backgroundImage="url("+mxWindow.prototype.minimizeImage+")";d.style.backgroundPosition="center center";d.style.backgroundRepeat="no-repeat";d.style.backgroundSize="10px";f.appendChild(d);var u=!1,v=!1,E=mxUtils.bind(this,
function(L){u=null!=this.currentMenu;v=b==this.currentPage;m.isMouseDown||v||this.selectPage(b);this.scrollToPage()}),F=mxUtils.bind(this,function(L){if(m.isEnabled()&&!m.isMouseDown&&(v&&(mxEvent.isTouchEvent(L)||mxEvent.getSource(L)==d)||mxEvent.isPopupTrigger(L))&&(m.popupMenuHandler.hideMenu(),this.hideCurrentMenu(),!mxEvent.isTouchEvent(L)||!u)){var N=new mxPopupMenu(this.createPageMenu(b));N.div.className+=" geMenubarMenu";N.smartSeparators=!0;N.showDisabled=!0;N.autoExpand=!0;N.hideMenu=mxUtils.bind(this,
function(){mxPopupMenu.prototype.hideMenu.apply(N,arguments);this.resetCurrentMenu();N.destroy()});var H=mxEvent.getClientX(L),R=mxEvent.getClientY(L);N.popup(H,R,null,L);this.setCurrentMenu(N,f)}mxEvent.consume(L)});mxEvent.addGestureListeners(d,E,null,F);mxEvent.addGestureListeners(f,E,null,F)};