Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
X||(ca.style.backgroundImage="url("+mxWindow.prototype.normalizeImage+")",ca.style.backgroundPosition="right 6px center",ca.style.backgroundRepeat="no-repeat",ca.style.paddingRight="22px");return ca}function c(W,X,Y,Z,ca,ha){var na=document.createElement("a");na.className="geMenuItem";na.style.display="inline-block";na.style.boxSizing="border-box";na.style.height="30px";na.style.padding="6px";na.style.position="relative";na.style.verticalAlign="top";na.style.top="0px";null!=t.statusContainer?B.insertBefore(na,
t.statusContainer):B.appendChild(na);null!=ha?(na.style.backgroundImage="url("+ha+")",na.style.backgroundPosition="center center",na.style.backgroundRepeat="no-repeat",na.style.backgroundSize="24px 24px",na.style.width="34px"):mxUtils.write(na,W);mxEvent.addListener(na,mxClient.IS_POINTER?"pointerdown":"mousedown",mxUtils.bind(this,function(ea){ea.preventDefault()}));mxEvent.addListener(na,"click",function(ea){"disabled"!=na.getAttribute("disabled")&&X(ea);mxEvent.consume(ea)});null==Y&&(na.style.marginRight=
"4px");null!=Z&&na.setAttribute("title",Z);null!=ca&&(W=function(){ca.isEnabled()?(na.removeAttribute("disabled"),na.style.cursor="pointer"):(na.setAttribute("disabled","disabled"),na.style.cursor="default")},ca.addListener("stateChanged",W),x.addListener("enabledChanged",W),W());return na}function e(W,X,Y){Y=document.createElement("div");Y.className="geMenuItem";Y.style.display="inline-block";Y.style.verticalAlign="top";Y.style.marginRight="6px";Y.style.padding="0 4px 0 4px";Y.style.height="30px";