Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){this.window.fit()}));this.window.addListener("hide",mxUtils.bind(this,function(){E.freehand.isDrawing()&&E.freehand.stopDrawing()}));b.installResizeHandler(this,!1)},TagsWindow=function(b,f,m,d,u){var v=b.editor.graph,E=b.editor.graph.createTagsDialog(mxUtils.bind(this,function(){return this.window.isVisible()}),null,function(L,N){if(v.isEnabled()){var H=new FilenameDialog(b,"",mxResources.get("add"),function(R){b.hideDialog();if(null!=R&&0<R.length){R=R.split(" ");for(var J=
[],c=0;c<R.length;c++){var e=mxUtils.trim(R[c]);""!=e&&0>mxUtils.indexOf(L,e)&&J.push(e)}0<J.length&&(v.isSelectionEmpty()?N(L.concat(J)):v.addTagsForCells(v.getSelectionCells(),J))}},mxResources.get("enterValue")+" ("+mxResources.get("tags")+")");b.showDialog(H.container,300,80,!0,!0);H.init()}}),F=E.div;this.window=new mxWindow(mxResources.get("tags"),F,f,m,d,u,!0,!0);this.window.minimumSize=new mxRectangle(0,0,212,120);this.window.destroyOnClose=!1;this.window.setMaximizable(!1);this.window.setResizable(!0);
this.window.setClosable(!0);this.window.addListener("show",mxUtils.bind(this,function(){E.refresh();this.window.fit()}));b.installResizeHandler(this,!0)},AuthDialog=function(b,f,m,d){var u=document.createElement("div");u.style.textAlign="center";var v=document.createElement("p");v.style.fontSize="16pt";v.style.padding="0px";v.style.margin="0px";v.style.color="gray";mxUtils.write(v,mxResources.get("authorizationRequired"));var E="Unknown",F=document.createElement("img");F.setAttribute("border","0");