Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var PopupDialog=function(b,f,m,d,u){u=null!=u?u:!0;var v=document.createElement("div");v.style.textAlign="left";v.style.height="100%";mxUtils.write(v,mxResources.get("fileOpenLocation"));mxUtils.br(v);mxUtils.br(v);var E=mxUtils.button(mxResources.get("openInThisWindow"),function(){u&&b.hideDialog();null!=d&&d()});E.className="geBtn";E.style.marginBottom="8px";E.style.width="280px";v.appendChild(E);mxUtils.br(v);var F=mxUtils.button(mxResources.get("openInNewWindow"),function(){u&&b.hideDialog();
null!=m&&m();b.openLink(f,null,!0)});F.className="geBtn gePrimaryBtn";F.style.width=E.style.width;v.appendChild(F);mxUtils.br(v);mxUtils.br(v);mxUtils.write(v,mxResources.get("allowPopups"));this.container=v},ImageDialog=function(b,f,m,d,u,v,E,F){function L(){0<R.value.length?t.removeAttribute("disabled"):t.setAttribute("disabled","disabled")}v=null!=v?v:!0;var N=b.editor.graph,H=document.createElement("div");mxUtils.write(H,f);f=document.createElement("div");f.className="geTitle";f.style.backgroundColor=