Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
}finally{g.getModel().endUpdate()}v&&(g.setSelectionCell(n),g.scrollCellToVisible(n))}};f=mxUtils.button(mxResources.get("preview"),function(){d(z,M,!1)});f.className="geBtn";E.appendChild(f);f=mxUtils.button(mxResources.get("apply"),function(){d(b.editor.graph,e,!0)});f.className="geBtn gePrimaryBtn";E.appendChild(f);b.editor.cancelFirst||E.appendChild(k);y.appendChild(E);x.appendChild(y);l.appendChild(x);this.container=l},CustomDialog=function(b,e,f,c,k,l,x,y,E,D,z,M){var I=document.createElement("div");