Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"ellipsis";G.setAttribute("title",J.title+" ("+J.id+")");var P=document.createElement("input");P.setAttribute("type","checkbox");P.checked=b.sidebar.isEntryVisible(J.id);P.defaultChecked=P.checked;G.appendChild(P);mxUtils.write(G," "+J.title);z.appendChild(G);var O=function(N){if(null==N||"INPUT"!=mxEvent.getSource(N).nodeName){M.style.textAlign="center";M.style.padding="0px";M.style.color="";M.innerText="";if(null!=J.desc){var T=document.createElement("pre");T.style.boxSizing="border-box";T.style.fontFamily=
"inherit";T.style.margin="20px";T.style.right="0px";T.style.textAlign="left";mxUtils.write(T,J.desc);M.appendChild(T)}null!=J.imageCallback?J.imageCallback(M):null!=J.image?M.innerHTML+='<img border="0" style="max-width:100%;" src="'+J.image+'"/>':null==J.desc&&(M.style.padding="20px",M.style.color="rgb(179, 179, 179)",mxUtils.write(M,mxResources.get("noPreview")));null!=I&&(I.style.backgroundColor="");I=G;I.style.backgroundColor=Editor.isDarkMode()?"#000000":"#ebf2f9";null!=N&&mxEvent.consume(N)}};