Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(da){"true"!=V.getAttribute("contentEditable")&&mxEvent.consume(da)});W=function(da){if(mxClient.IS_IOS||mxClient.IS_FF||!(null==document.documentMode||9<document.documentMode)){var ma=new FilenameDialog(b,X.title||"",mxResources.get("ok"),function(ea){null!=ea&&(X.title=ea,T())},mxResources.get("enterValue"));b.showDialog(ma.container,300,80,!0,!0);ma.init();mxEvent.consume(da)}else if("true"!=V.getAttribute("contentEditable")){null!=v&&(v(),v=null);if(null==X.title||0==X.title.length)V.innerText=
"";V.style.textOverflow="";V.style.whiteSpace="";V.style.cursor="text";V.style.color="";V.setAttribute("contentEditable","true");mxUtils.setPrefixedStyle(V.style,"user-select","text");V.focus();document.execCommand("selectAll",!1,null);v=function(){V.removeAttribute("contentEditable");V.style.cursor="pointer";X.title=V.innerHTML;T()};mxEvent.consume(da)}};mxEvent.addListener(V,"click",W);mxEvent.addListener(R,"dblclick",W);d.appendChild(R);mxEvent.addListener(R,"dragstart",function(da){null==S&&null!=