Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){b.hideDialog()})});E.className="geBtn";b.editor.cancelFirst&&e.appendChild(E);D=mxUtils.button(mxResources.get("insert"),function(d){try{b.hideDialog(),c(x.value,y.value,d)}catch(g){b.handleError(g)}});D.className="geBtn gePrimaryBtn";e.appendChild(D);b.editor.cancelFirst||e.appendChild(E);this.container=e},NewDialog=function(b,e,f,c,k,l,x,y,E,D,z,M,I,d,g,n,t,u){function v(aa){null!=aa&&(Ka=oa=aa?135:140);aa=!0;if(null!=Ga)for(;O<Ga.length&&(aa||0!=mxUtils.mod(O,30));){var la=Ga[O++];la=
S(la.url,la.libs,la.title,la.tooltip?la.tooltip:la.title,la.select,la.imgUrl,la.info,la.onClick,la.preview,la.noImg,la.clibs);aa&&la.click();aa=!1}}function A(aa,la,na,pa,ha,ka){if(null!=aa&&mxUtils.isAncestorNode(document.body,pa)){aa=mxUtils.parseXml(aa);aa=Editor.parseDiagramNode(aa.documentElement);var ua=new mxCodec(aa.ownerDocument),wa=new mxGraphModel;ua.decode(aa,wa);aa=wa.root.getChildAt(0).children;b.sidebar.createTooltip(pa,aa,Math.min((window.innerWidth||document.documentElement.clientWidth||