Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
""),Da.value=sa,Da.style.width="96px",Da.style.borderWidth="0px",Ga.appendChild(Da)):(Ga.innerHTML=mxUtils.htmlEntities(decodeURIComponent(sa)),mxEvent.addListener(Ga,"click",mxUtils.bind(Z,function(){function Ua(){var aa=ja.value;aa=0==aa.length&&"string"!=Fa?0:aa;va.allowAuto&&(null!=aa.trim&&"auto"==aa.trim().toLowerCase()?(aa="auto",Fa="string"):(aa=parseFloat(aa),aa=isNaN(aa)?0:aa));null!=va.min&&aa<va.min?aa=va.min:null!=va.max&&aa>va.max&&(aa=va.max);aa=encodeURIComponent(("int"==Fa?parseInt(aa):
aa)+"");R(oa,aa,va)}var ja=document.createElement("input");U(Ga,ja,!0);ja.value=decodeURIComponent(sa);ja.className="gePropEditor";"int"!=Fa&&"float"!=Fa||va.allowAuto||(ja.type="number",ja.step="int"==Fa?"1":"any",null!=va.min&&(ja.min=parseFloat(va.min)),null!=va.max&&(ja.max=parseFloat(va.max)));m.appendChild(ja);mxEvent.addListener(ja,"keypress",function(aa){13==aa.keyCode&&Ua()});ja.focus();mxEvent.addListener(ja,"blur",function(){Ua()})})));va.isDeletable&&(Da=mxUtils.button("-",mxUtils.bind(Z,