Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"geBtn gePrimaryBtn";var g=document.createElement("img");g.setAttribute("src",Sidebar.prototype.searchImage);g.setAttribute("title",mxResources.get("preview"));g.className="geActiveButton";g.style.position="absolute";g.style.cursor="default";g.style.padding="8px";g.style.right="0px";g.style.top="0px";var y=!1,H=null,O=!1;if(S||J){var P=[],V=null,R=null,W=null,X=function(aa){U.setAttribute("disabled","disabled");for(var la=0;la<P.length;la++)P[la].className=la==aa?"geBtn gePrimaryBtn":"geBtn"};E=!0;