Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
za.className="gePropHeaderCell";var Ba=document.createElement("img");Ba.src=Sidebar.prototype.expandedImage;Ba.style.verticalAlign="middle";za.appendChild(Ba);mxUtils.write(za,mxResources.get("property"));ea.style.cursor="pointer";var Ca=function(){var oa=ma.querySelectorAll(".gePropNonHeaderRow");if(Z.editorUi.propertiesCollapsed){Ba.src=Sidebar.prototype.collapsedImage;var sa="none";for(var va=m.childNodes.length-1;0<=va;va--)try{var Ea=m.childNodes[va],Da=Ea.nodeName.toUpperCase();"INPUT"!=Da&&
"SELECT"!=Da||m.removeChild(Ea)}catch(Qa){}}else Ba.src=Sidebar.prototype.expandedImage,sa="";for(va=0;va<oa.length;va++)oa[va].style.display=sa};mxEvent.addListener(ea,"click",function(){Z.editorUi.propertiesCollapsed=!Z.editorUi.propertiesCollapsed;Ca()});ea.appendChild(za);za=document.createElement("th");za.className="gePropHeaderCell";za.innerHTML=mxResources.get("value");ea.appendChild(za);ma.appendChild(ea);var ba=!1,fa=!1;ea=null;1==K.vertices.length&&0==K.edges.length?ea=K.vertices[0].id: