Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
N.appendChild(v);R.appendChild(N);L?(N.style.marginTop="10px",J=document.createElement("p"),J.style.marginTop="20px",J.style.marginBottom="0px",J.appendChild(c),u=document.createElement("span"),mxUtils.write(u," "+mxResources.get("rememberThisSetting")),J.appendChild(u),R.appendChild(J),mxEvent.addListener(u,"click",function(g){c.checked=!c.checked;mxEvent.consume(g)})):N.style.marginTop="12px";this.init=function(){e.focus()};this.container=R},HeadlessEditorUi=function(){EditorUi.call(this,new Editor(!0),
document.createElement("div"),!0)};mxUtils.extend(HeadlessEditorUi,EditorUi);HeadlessEditorUi.prototype.createUi=function(){};HeadlessEditorUi.prototype.addTrees=function(){};HeadlessEditorUi.prototype.onBeforeUnload=function(){};HeadlessEditorUi.prototype.updateActionStates=function(){};EditorUi.DIFF_INSERT="i";EditorUi.DIFF_REMOVE="r";EditorUi.DIFF_UPDATE="u";EditorUi.transientViewStateProperties="defaultParent currentRoot scrollLeft scrollTop scale translate lastPasteXml pasteCounter".split(" ");EditorUi.prototype.viewStateProperties={background:!0,backgroundImage:!0,shadowVisible:!0,foldingEnabled:!0,pageScale:!0,mathEnabled:!0,pageFormat:!0,extFonts:!0};