Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var PopupDialog=function(b,f,m,d,u){u=null!=u?u:!0;var v=document.createElement("div");v.style.textAlign="left";v.style.height="100%";mxUtils.write(v,mxResources.get("fileOpenLocation"));mxUtils.br(v);mxUtils.br(v);var D=mxUtils.button(mxResources.get("openInThisWindow"),function(){u&&b.hideDialog();null!=d&&d()});D.className="geBtn";D.style.marginBottom="8px";D.style.width="280px";v.appendChild(D);mxUtils.br(v);var F=mxUtils.button(mxResources.get("openInNewWindow"),function(){u&&b.hideDialog();
null!=m&&m();b.openLink(f,null,!0)});F.className="geBtn gePrimaryBtn";F.style.width=D.style.width;v.appendChild(F);mxUtils.br(v);mxUtils.br(v);mxUtils.write(v,mxResources.get("allowPopups"));this.container=v},ImageDialog=function(b,f,m,d,u,v,D,F){function K(){0<S.value.length?t.removeAttribute("disabled"):t.setAttribute("disabled","disabled")}v=null!=v?v:!0;var M=b.editor.graph,G=document.createElement("div");mxUtils.write(G,f);f=document.createElement("div");f.className="geTitle";f.style.backgroundColor=