Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x.appendChild(z);var E=document.createElement("div");E.style.marginTop="10px";if(v){var A=function(U,g,y,H,O){if(null==O||"1"!=O.html)return H=U.toLowerCase().indexOf(g,H),0>H?U:U.substr(0,H)+y+U.substr(H+g.length);var P=U;g=mxUtils.htmlEntities(g);O=[];var V=-1;for(U=U.replace(/<br>/ig,"\n");-1<(V=U.indexOf("<",V+1));)O.push(V);V=U.match(/<[^>]*>/g);U=U.replace(/<[^>]*>/g,"");H=U.toLowerCase().indexOf(g,H);if(0>H)return P;P=H+g.length;y=mxUtils.htmlEntities(y);U=U.substr(0,H)+y+U.substr(P);for(var R=
0,W=0;W<O.length;W++){if(O[W]-R<H)U=U.substr(0,O[W])+V[W]+U.substr(O[W]);else{var X=O[W]-R<P?H+R:O[W]+(y.length-g.length);U=U.substr(0,X)+V[W]+U.substr(X)}R+=V[W].length}return U.replace(/\n/g,"<br>")},N=mxUtils.button(mxResources.get("replFind"),function(){try{if(null!=k&&null!=J){var U=J.cell,g=G.getLabel(U);G.isCellEditable(U)&&G.model.setValue(U,A(g,k,I.value,q-k.length,G.getCurrentCellStyle(U)));C.style.backgroundColor=K(!1,!0)?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}}catch(y){b.handleError(y)}});