Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,f){var k=this.addCheckbox(d,mxResources.get("edit")+":",!0,null,!0);k.style.marginLeft="24px";var v=this.getCurrentFile(),z="";null!=v&&v.getMode()!=App.MODE_DEVICE&&v.getMode()!=App.MODE_BROWSER&&(z=window.location.href);var A=document.createElement("select");A.style.maxWidth="200px";A.style.width="auto";A.style.marginLeft="8px";A.style.marginRight="10px";A.className="geBtn";v=document.createElement("option");v.setAttribute("value","blank");mxUtils.write(v,mxResources.get("makeCopy"));
A.appendChild(v);v=document.createElement("option");v.setAttribute("value","custom");mxUtils.write(v,mxResources.get("custom")+"...");A.appendChild(v);d.appendChild(A);mxEvent.addListener(A,"change",mxUtils.bind(this,function(){if("custom"==A.value){var H=new FilenameDialog(this,z,mxResources.get("ok"),function(J){null!=J?z=J:A.value="blank"},mxResources.get("url"),null,null,null,null,function(){A.value="blank"});this.showDialog(H.container,300,80,!0,!1);H.init()}}));mxEvent.addListener(k,"change",
mxUtils.bind(this,function(){k.checked&&(null==f||f.checked)?A.removeAttribute("disabled"):A.setAttribute("disabled","disabled")}));mxUtils.br(d);return{getLink:function(){return k.checked?"blank"===A.value?"_blank":z:null},getEditInput:function(){return k},getEditSelect:function(){return A}}};EditorUi.prototype.addLinkSection=function(d,f){function k(){var J=document.createElement("div");J.style.width="100%";J.style.height="100%";J.style.boxSizing="border-box";null!=A&&A!=mxConstants.NONE?(J.style.border=