Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){this.window.fit()}));this.window.addListener("hide",mxUtils.bind(this,function(){x.freehand.isDrawing()&&x.freehand.stopDrawing()}));b.installResizeHandler(this,!1)},TagsWindow=function(b,e,f,c,k){var l=b.editor.graph,x=b.editor.graph.createTagsDialog(mxUtils.bind(this,function(){return this.window.isVisible()}),null,function(E,D){if(l.isEnabled()){var z=new FilenameDialog(b,"",mxResources.get("add"),function(M){b.hideDialog();if(null!=M&&0<M.length){M=M.split(" ");for(var I=
[],d=0;d<M.length;d++){var g=mxUtils.trim(M[d]);""!=g&&0>mxUtils.indexOf(E,g)&&I.push(g)}0<I.length&&(l.isSelectionEmpty()?D(E.concat(I)):l.addTagsForCells(l.getSelectionCells(),I))}},mxResources.get("enterValue")+" ("+mxResources.get("tags")+")");b.showDialog(z.container,300,80,!0,!0);z.init()}}),y=x.div;this.window=new mxWindow(mxResources.get("tags"),y,e,f,c,k,!0,!0);this.window.minimumSize=new mxRectangle(0,0,212,120);this.window.destroyOnClose=!1;this.window.setMaximizable(!1);this.window.setResizable(!0);
this.window.setClosable(!0);this.window.addListener("show",mxUtils.bind(this,function(){x.refresh();this.window.fit()}));b.installResizeHandler(this,!0)},AuthDialog=function(b,e,f,c){var k=document.createElement("div");k.style.textAlign="center";var l=document.createElement("p");l.style.fontSize="16pt";l.style.padding="0px";l.style.margin="0px";l.style.color="gray";mxUtils.write(l,mxResources.get("authorizationRequired"));var x="Unknown",y=document.createElement("img");y.setAttribute("border","0");