Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"none",d.style.display="none");var t=document.createElement("option"),u=!1,v=!1,A=function(G,P){u||null!=G&&v||(M.checked?null!=P&&P(t.selected?null:d.value):""==I.value||b.isOffline()?(L.value="",F.value="",null!=P&&P("")):(I.value=mxUtils.trim(I.value),b.loadImage(I.value,function(O){L.value=O.width;F.value=O.height;null!=P&&P(I.value)},function(){b.showError(mxResources.get("error"),mxResources.get("fileNotFound"),mxResources.get("ok"));L.value="";F.value="";null!=P&&P(null)})))},H=mxUtils.bind(this,