Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
PrintDialog.prototype.create=function(b){function e(d){var f=E.checked||F.checked,k=parseInt(R.value)/100;isNaN(k)&&(k=1,R.value="100%");mxClient.IS_SF&&(k*=.75);var v=g.pageFormat||mxConstants.PAGE_FORMAT_A4_PORTRAIT,z=1/g.pageScale;if(f){var A=E.checked?1:parseInt(K.value);isNaN(A)||(z=mxUtils.getScaleForPageCount(A,g,v))}var H=A=0;v=mxRectangle.fromRectangle(v);v.width=Math.ceil(v.width*k);v.height=Math.ceil(v.height*k);z*=k;!f&&g.pageVisible?(k=g.getPageLayout(),A-=k.x*v.width,H-=k.y*v.height):
f=!0;f=PrintDialog.createPrintPreview(g,z,v,0,A,H,f);f.open();d&&PrintDialog.printPreview(f)}var g=b.editor.graph,n=document.createElement("table");n.style.width="100%";n.style.height="100%";var y=document.createElement("tbody");var q=document.createElement("tr");var E=document.createElement("input");E.setAttribute("type","checkbox");var N=document.createElement("td");N.setAttribute("colspan","2");N.style.fontSize="10pt";N.appendChild(E);var T=document.createElement("span");mxUtils.write(T," "+mxResources.get("fitPage"));