Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){b.hideDialog()})});L.className="geBtn";b.editor.cancelFirst&&f.appendChild(L);N=mxUtils.button(mxResources.get("insert"),function(c){try{b.hideDialog(),d(E.value,F.value,c)}catch(e){b.handleError(e)}});N.className="geBtn gePrimaryBtn";f.appendChild(N);b.editor.cancelFirst||f.appendChild(L);this.container=f},NewDialog=function(b,f,m,d,u,v,E,F,L,N,H,R,J,c,e,g,q,p){function t(aa){null!=aa&&(Qa=pa=aa?135:140);aa=!0;if(null!=Ha)for(;K<Ha.length&&(aa||0!=mxUtils.mod(K,30));){var la=Ha[K++];la=
S(la.url,la.libs,la.title,la.tooltip?la.tooltip:la.title,la.select,la.imgUrl,la.info,la.onClick,la.preview,la.noImg,la.clibs);aa&&la.click();aa=!1}}function x(aa,la,ma,oa,fa,ja){if(null!=aa&&mxUtils.isAncestorNode(document.body,oa)){aa=mxUtils.parseXml(aa);aa=Editor.parseDiagramNode(aa.documentElement);var sa=new mxCodec(aa.ownerDocument),ta=new mxGraphModel;sa.decode(aa,ta);aa=ta.root.getChildAt(0).children;b.sidebar.createTooltip(oa,aa,Math.min((window.innerWidth||document.documentElement.clientWidth||