Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0));mxEvent.addListener(la,"change",pa);mxEvent.addListener(la,"keydown",pa);mxEvent.addListener(la,"cut",pa);mxEvent.addListener(la,"paste",pa);mxEvent.addListener(la,"keydown",function(Ia){13==Ia.keyCode&&Ma.click()});pa=document.createElement("div");pa.style.height="40px";pa.style.marginTop="4px";pa.style.marginBottom="4px";pa.style.whiteSpace="nowrap";pa.style.overflowX="auto";pa.style.overflowY="hidden";pa.appendChild(ha);pa.appendChild(Ma);aa.appendChild(pa);aa.appendChild(na);return aa}function L(){if(za&&
null!=d)f||b.hideDialog(),d(za,Ca,P.value);else if(c)f||b.hideDialog(),c(ma,P.value,Ba,ca);else{var aa=P.value;null!=aa&&0<aa.length&&b.pickFolder(b.mode,function(la){b.createFile(aa,ma,null!=ca&&0<ca.length?ca:null,null,function(){b.hideDialog()},null,la,null,null!=da&&0<da.length?da:null)},b.mode!=App.MODE_GOOGLE||null==b.stateArg||null==b.stateArg.folderId)}}function F(aa,la,na,pa,ha,ka,ua){null!=ea&&(ea.style.backgroundColor="transparent",ea.style.border="1px solid transparent");T.removeAttribute("disabled");