Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.addTabListeners=function(b,e){mxEvent.disableContextMenu(e);var f=this.editor.graph;mxEvent.addListener(e,"dblclick",mxUtils.bind(this,function(E){this.renamePage(b);mxEvent.consume(E)}));var c=document.createElement("div");c.className="geTabMenuButton";c.style.backgroundImage="url("+mxWindow.prototype.minimizeImage+")";c.style.backgroundPosition="center center";c.style.backgroundRepeat="no-repeat";c.style.backgroundSize="10px";e.appendChild(c);var k=!1,l=!1,x=mxUtils.bind(this,
function(E){k=null!=this.currentMenu;l=b==this.currentPage;f.isMouseDown||l||this.selectPage(b);this.scrollToPage()}),y=mxUtils.bind(this,function(E){if(f.isEnabled()&&!f.isMouseDown&&(l&&(mxEvent.isTouchEvent(E)||mxEvent.getSource(E)==c)||mxEvent.isPopupTrigger(E))&&(f.popupMenuHandler.hideMenu(),this.hideCurrentMenu(),!mxEvent.isTouchEvent(E)||!k)){var D=new mxPopupMenu(this.createPageMenu(b));D.div.className+=" geMenubarMenu";D.smartSeparators=!0;D.showDisabled=!0;D.autoExpand=!0;D.hideMenu=mxUtils.bind(this,
function(){mxPopupMenu.prototype.hideMenu.apply(D,arguments);this.resetCurrentMenu();D.destroy()});var z=mxEvent.getClientX(E),M=mxEvent.getClientY(E);D.popup(z,M,null,E);this.setCurrentMenu(D,e)}mxEvent.consume(E)});mxEvent.addGestureListeners(c,x,null,y);mxEvent.addGestureListeners(e,x,null,y)};