Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"120px",z.style.backgroundImage="url('"+IMAGE_PATH+"/droptarget.png')",z.style.backgroundPosition="center 65%",z.style.backgroundRepeat="no-repeat",x=document.createElement("div"),x.style.position="absolute",x.style.width="420px",x.style.top="58%",x.style.textAlign="center",x.style.fontSize="18px",x.style.color="#a0c3ff",mxUtils.write(x,mxResources.get("dragImagesHere")),z.appendChild(x));z.appendChild(y);this.container=z},LinkDialog=function(b,e,f,c,k,l,x){function y(A,H,L){L=mxUtils.button("",L);
L.className="geBtn";L.setAttribute("title",H);H=document.createElement("img");H.style.height="26px";H.style.width="26px";H.setAttribute("src",A);L.style.minWidth="42px";L.style.verticalAlign="middle";L.appendChild(H);v.appendChild(L)}var E=document.createElement("div");E.style.height="100%";mxUtils.write(E,mxResources.get("editLink")+":");var D=document.createElement("div");D.className="geTitle";D.style.backgroundColor="transparent";D.style.borderColor="transparent";D.style.whiteSpace="nowrap";D.style.textOverflow=