Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var StorageDialog=function(b,f,m){function d(R,J,c,e,g,q){function p(){mxEvent.addListener(t,"click",null!=q?q:function(){c==App.MODE_GOOGLE&&b.spinner.spin(document.body,mxResources.get("authorizing"))?b.drive.checkToken(mxUtils.bind(this,function(){b.spinner.stop();b.setMode(c,!0);f()})):c==App.MODE_ONEDRIVE&&b.spinner.spin(document.body,mxResources.get("authorizing"))?b.oneDrive.checkToken(mxUtils.bind(this,function(){b.spinner.stop();b.setMode(c,!0);f()}),function(S){b.spinner.stop();b.handleError(S)}):
(b.setMode(c,!0),f())})}F++;++E>m&&(mxUtils.br(L),E=1);var t=document.createElement("a");t.style.overflow="hidden";t.style.display="inline-block";t.className="geBaseButton";t.style.boxSizing="border-box";t.style.fontSize="11px";t.style.position="relative";t.style.margin="4px";t.style.marginTop="8px";t.style.marginBottom="0px";t.style.padding="8px 10px 8px 10px";t.style.width="88px";t.style.height="100px";t.style.whiteSpace="nowrap";t.setAttribute("title",J);var x=document.createElement("div");x.style.textOverflow=