Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
m=mxUtils.button(m,d);m.insertBefore(F,m.firstChild);m.style.marginTop="6px";m.className="geBigButton";m.style.fontSize="18px";m.style.padding="14px";u.appendChild(v);u.appendChild(b);u.appendChild(m);this.container=u},FontDialog=function(b,f,m,d,u){function v(x){this.style.border="";13==x.keyCode&&t.click()}var E=document.createElement("table"),F=document.createElement("tbody");E.style.marginTop="8px";var L=document.createElement("tr");var N=document.createElement("td");N.colSpan=2;N.style.whiteSpace=