Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
FilenameDialog.createTypeHint=function(b,e,g){var p=document.createElement("img");p.style.backgroundPosition="center bottom";p.style.backgroundRepeat="no-repeat";p.style.margin="2px 0 0 4px";p.style.verticalAlign="top";p.style.cursor="pointer";p.style.height="16px";p.style.width="16px";mxUtils.setOpacity(p,70);var y=function(){p.setAttribute("src",Editor.helpImage);p.setAttribute("title",mxResources.get("help"));for(var q=0;q<g.length;q++)if(0<g[q].ext.length&&e.value.toLowerCase().substring(e.value.length-
g[q].ext.length-1)=="."+g[q].ext){p.setAttribute("title",mxResources.get(g[q].title));break}};mxEvent.addListener(e,"keyup",y);mxEvent.addListener(e,"change",y);mxEvent.addListener(p,"click",function(q){var E=p.getAttribute("title");p.getAttribute("src")==Editor.helpImage?b.editor.graph.openLink(FilenameDialog.filenameHelpLink):""!=E&&b.showError(null,E,mxResources.get("help"),function(){b.editor.graph.openLink(FilenameDialog.filenameHelpLink)},null,mxResources.get("ok"),null,null,null,340,90);mxEvent.consume(q)});