Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
za.className="gePropHeaderCell";var Ca=document.createElement("img");Ca.src=Sidebar.prototype.expandedImage;Ca.style.verticalAlign="middle";za.appendChild(Ca);mxUtils.write(za,mxResources.get("property"));ea.style.cursor="pointer";var Ba=function(){var pa=na.querySelectorAll(".gePropNonHeaderRow");if(Z.editorUi.propertiesCollapsed){Ca.src=Sidebar.prototype.collapsedImage;var ua="none";for(var va=k.childNodes.length-1;0<=va;va--)try{var Ea=k.childNodes[va],Da=Ea.nodeName.toUpperCase();"INPUT"!=Da&&
"SELECT"!=Da||k.removeChild(Ea)}catch(Ta){}}else Ca.src=Sidebar.prototype.expandedImage,ua="";for(va=0;va<pa.length;va++)pa[va].style.display=ua};mxEvent.addListener(ea,"click",function(){Z.editorUi.propertiesCollapsed=!Z.editorUi.propertiesCollapsed;Ba()});ea.appendChild(za);za=document.createElement("th");za.className="gePropHeaderCell";za.innerHTML=mxResources.get("value");ea.appendChild(za);na.appendChild(ea);var ba=!1,da=!1;ea=null;1==G.vertices.length&&0==G.edges.length?ea=G.vertices[0].id: