Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
arguments);N.style.backgroundColor=""};H.dblClick=function(){};var P=H.getSelectionModel().changeSelection;H.getSelectionModel().changeSelection=function(){P.call(this,[c],[c])}};L.onerror=function(){L.onload=null;L.src=Editor.errorImage};L.setAttribute("src",f);L.style.maxWidth="300px";L.style.maxHeight="300px";F.appendChild(L);E.appendChild(F);var N=document.createElement("div");N.style.width="300px";N.style.height="300px";N.style.overflow="hidden";N.style.backgroundColor="#fff9";E.appendChild(N);