Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
""),Da.value=ua,Da.style.width="96px",Da.style.borderWidth="0px",Ha.appendChild(Da)):(Ha.innerHTML=mxUtils.htmlEntities(decodeURIComponent(ua)),mxEvent.addListener(Ha,"click",mxUtils.bind(Z,function(){function Ua(){var aa=ia.value;aa=0==aa.length&&"string"!=Ia?0:aa;va.allowAuto&&(null!=aa.trim&&"auto"==aa.trim().toLowerCase()?(aa="auto",Ia="string"):(aa=parseFloat(aa),aa=isNaN(aa)?0:aa));null!=va.min&&aa<va.min?aa=va.min:null!=va.max&&aa>va.max&&(aa=va.max);aa=encodeURIComponent(("int"==Ia?parseInt(aa):
aa)+"");P(pa,aa,va)}var ia=document.createElement("input");Q(Ha,ia,!0);ia.value=decodeURIComponent(ua);ia.className="gePropEditor";"int"!=Ia&&"float"!=Ia||va.allowAuto||(ia.type="number",ia.step="int"==Ia?"1":"any",null!=va.min&&(ia.min=parseFloat(va.min)),null!=va.max&&(ia.max=parseFloat(va.max)));k.appendChild(ia);mxEvent.addListener(ia,"keypress",function(aa){13==aa.keyCode&&Ua()});ia.focus();mxEvent.addListener(ia,"blur",function(){Ua()})})));va.isDeletable&&(Da=mxUtils.button("-",mxUtils.bind(Z,