Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.addTabListeners=function(b,e){mxEvent.disableContextMenu(e);var g=this.editor.graph;mxEvent.addListener(e,"dblclick",mxUtils.bind(this,function(S){this.renamePage(b);mxEvent.consume(S)}));var n=document.createElement("div");n.className="geTabMenuButton";n.style.backgroundImage="url("+mxWindow.prototype.minimizeImage+")";n.style.backgroundPosition="center center";n.style.backgroundRepeat="no-repeat";n.style.backgroundSize="10px";e.appendChild(n);var y=!1,q=!1,E=mxUtils.bind(this,
function(S){y=null!=this.currentMenu;q=b==this.currentPage;g.isMouseDown||q||this.selectPage(b);this.scrollToPage()}),K=mxUtils.bind(this,function(S){if(g.isEnabled()&&!g.isMouseDown&&(q&&(mxEvent.isTouchEvent(S)||mxEvent.getSource(S)==n)||mxEvent.isPopupTrigger(S))&&(g.popupMenuHandler.hideMenu(),this.hideCurrentMenu(),!mxEvent.isTouchEvent(S)||!y)){var G=new mxPopupMenu(this.createPageMenu(b));G.div.className+=" geMenubarMenu";G.smartSeparators=!0;G.showDisabled=!0;G.autoExpand=!0;G.hideMenu=mxUtils.bind(this,
function(){mxPopupMenu.prototype.hideMenu.apply(G,arguments);this.resetCurrentMenu();G.destroy()});var L=mxEvent.getClientX(S),R=mxEvent.getClientY(S);G.popup(L,R,null,S);this.setCurrentMenu(G,e)}mxEvent.consume(S)});mxEvent.addGestureListeners(n,E,null,K);mxEvent.addGestureListeners(e,E,null,K)};