Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.addRadiobox=function(d,f,l,u,A,B,F){return this.addCheckbox(d,l,u,A,B,F,!0,f)};EditorUi.prototype.addCheckbox=function(d,f,l,u,A,B,F,M){B=null!=B?B:!0;var O=document.createElement("input");O.style.marginRight="8px";O.style.marginTop="16px";O.setAttribute("type",F?"radio":"checkbox");F="geCheckbox-"+Editor.guid();O.id=F;null!=M&&O.setAttribute("name",M);l&&(O.setAttribute("checked","checked"),O.defaultChecked=!0);u&&O.setAttribute("disabled","disabled");B&&(d.appendChild(O),l=document.createElement("label"),
mxUtils.write(l,f),l.setAttribute("for",F),d.appendChild(l),A||mxUtils.br(d));return O};EditorUi.prototype.addEditButton=function(d,f){var l=this.addCheckbox(d,mxResources.get("edit")+":",!0,null,!0);l.style.marginLeft="24px";var u=this.getCurrentFile(),A="";null!=u&&u.getMode()!=App.MODE_DEVICE&&u.getMode()!=App.MODE_BROWSER&&(A=window.location.href);var B=document.createElement("select");B.style.maxWidth="200px";B.style.width="auto";B.style.marginLeft="8px";B.style.marginRight="10px";B.className=