Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,g,n,t,u){var v=document.createElement("div");v.style.whiteSpace="nowrap";var A=document.createElement("h3");mxUtils.write(A,mxResources.get("image"));A.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:"+(u?"10":"4")+"px";v.appendChild(A);if(u){mxUtils.write(v,mxResources.get("zoom")+":");var H=document.createElement("input");H.setAttribute("type","text");H.style.marginRight="16px";H.style.width="60px";H.style.marginLeft="4px";H.style.marginRight="12px";H.value=this.lastExportZoom||
"100%";v.appendChild(H);mxUtils.write(v,mxResources.get("borderWidth")+":");var L=document.createElement("input");L.setAttribute("type","text");L.style.marginRight="16px";L.style.width="60px";L.style.marginLeft="4px";L.value=this.lastExportBorder||"0";v.appendChild(L);mxUtils.br(v)}var F=this.addCheckbox(v,mxResources.get("selectionOnly"),!1,this.editor.graph.isSelectionEmpty()),S=t?null:this.addCheckbox(v,mxResources.get("includeCopyOfMyDiagram"),Editor.defaultIncludeDiagram);A=this.editor.graph;
var p=t?null:this.addCheckbox(v,mxResources.get("transparentBackground"),A.background==mxConstants.NONE||null==A.background);null!=p&&(p.style.marginBottom="16px");d=new CustomDialog(this,v,mxUtils.bind(this,function(){var q=parseInt(H.value)/100||1,C=parseInt(L.value)||0;n(!F.checked,null!=S?S.checked:!1,null!=p?p.checked:!1,q,C)}),null,d,g);this.showDialog(d.container,300,(u?25:0)+(t?125:210),!0,!0)};EditorUi.prototype.showExportDialog=function(d,g,n,t,u,v,A,H,L){A=null!=A?A:Editor.defaultIncludeDiagram;