Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
encodeURIComponent(G.name);y="";v()})));z.appendChild(O)})(C[J],J);100==C.length&&(z.appendChild(t),u=function(){z.scrollTop>=z.scrollHeight-z.offsetHeight&&p()},mxEvent.addListener(z,"scroll",u))}}))}),n)});I.okButton.setAttribute("disabled","disabled");this.ui.spinner.spin(z,mxResources.get("loading"));var H=mxUtils.bind(this,function(L){var F=this.ui.spinner,S=0;this.ui.spinner.stop();var p=function(){F.spin(z,mxResources.get("loading"));S+=1},q=function(){--S;0===S&&F.stop()};null==L&&(z.innerText=