Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
PrintDialog.createPrintPreview=function(b,e,g,n,y,q,E){e=new mxPrintPreview(b,e,g,n,y,q);e.title=mxResources.get("preview");e.addPageCss=!mxClient.IS_SF;e.printBackgroundImage=!0;e.autoOrigin=E;b=b.background;if(null==b||""==b||b==mxConstants.NONE)b="#ffffff";e.backgroundColor=b;var N=e.writeHead;e.writeHead=function(T){N.apply(this,arguments);T.writeln('<style type="text/css">');T.writeln("@media screen {");T.writeln("  body > div { padding:30px;box-sizing:content-box; }");T.writeln("}");T.writeln("</style>")};
return e};PrintDialog.previewEnabled=!0;