Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"120px",H.style.backgroundImage="url('"+IMAGE_PATH+"/droptarget.png')",H.style.backgroundPosition="center 65%",H.style.backgroundRepeat="no-repeat",E=document.createElement("div"),E.style.position="absolute",E.style.width="420px",E.style.top="58%",E.style.textAlign="center",E.style.fontSize="18px",E.style.color="#a0c3ff",mxUtils.write(E,mxResources.get("dragImagesHere")),H.appendChild(E));H.appendChild(F);this.container=H},LinkDialog=function(b,f,m,d,u,v,E){function F(x,B,I){I=mxUtils.button("",I);
I.className="geBtn";I.setAttribute("title",B);B=document.createElement("img");B.style.height="26px";B.style.width="26px";B.setAttribute("src",x);I.style.minWidth="42px";I.style.verticalAlign="middle";I.appendChild(B);t.appendChild(I)}var L=document.createElement("div");L.style.height="100%";mxUtils.write(L,mxResources.get("editLink")+":");var N=document.createElement("div");N.className="geTitle";N.style.backgroundColor="transparent";N.style.borderColor="transparent";N.style.whiteSpace="nowrap";N.style.textOverflow=