Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c,e,g,q,p){var t=document.createElement("div");t.style.whiteSpace="nowrap";var x=document.createElement("h3");mxUtils.write(x,mxResources.get("image"));x.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:"+(p?"10":"4")+"px";t.appendChild(x);if(p){mxUtils.write(t,mxResources.get("zoom")+":");var B=document.createElement("input");B.setAttribute("type","text");B.style.marginRight="16px";B.style.width="60px";B.style.marginLeft="4px";B.style.marginRight="12px";B.value=this.lastExportZoom||
"100%";t.appendChild(B);mxUtils.write(t,mxResources.get("borderWidth")+":");var I=document.createElement("input");I.setAttribute("type","text");I.style.marginRight="16px";I.style.width="60px";I.style.marginLeft="4px";I.value=this.lastExportBorder||"0";t.appendChild(I);mxUtils.br(t)}var A=this.addCheckbox(t,mxResources.get("selectionOnly"),!1,this.editor.graph.isSelectionEmpty()),S=q?null:this.addCheckbox(t,mxResources.get("includeCopyOfMyDiagram"),Editor.defaultIncludeDiagram);x=this.editor.graph;
var l=q?null:this.addCheckbox(t,mxResources.get("transparentBackground"),x.background==mxConstants.NONE||null==x.background);null!=l&&(l.style.marginBottom="16px");c=new CustomDialog(this,t,mxUtils.bind(this,function(){var n=parseInt(B.value)/100||1,z=parseInt(I.value)||0;g(!A.checked,null!=S?S.checked:!1,null!=l?l.checked:!1,n,z)}),null,c,e);this.showDialog(c.container,300,(p?25:0)+(q?125:210),!0,!0)};EditorUi.prototype.showExportDialog=function(c,e,g,q,p,t,x,B,I){x=null!=x?x:Editor.defaultIncludeDiagram;