Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t.setAttribute("disabled","disabled")}));mxUtils.br(c);return{getLink:function(){return g.checked?"blank"===t.value?"_blank":p:null},getEditInput:function(){return g},getEditSelect:function(){return t}}};EditorUi.prototype.addLinkSection=function(c,e){function g(){var B=document.createElement("div");B.style.width="100%";B.style.height="100%";B.style.boxSizing="border-box";null!=t&&t!=mxConstants.NONE?(B.style.border="1px solid black",B.style.backgroundColor=t):(B.style.backgroundPosition="center center",
B.style.backgroundRepeat="no-repeat",B.style.backgroundImage="url('"+Dialog.prototype.closeImage+"')");x.innerText="";x.appendChild(B)}mxUtils.write(c,mxResources.get("links")+":");var q=document.createElement("select");q.style.width="100px";q.style.padding="0px";q.style.marginLeft="8px";q.style.marginRight="10px";q.className="geBtn";var p=document.createElement("option");p.setAttribute("value","auto");mxUtils.write(p,mxResources.get("automatic"));q.appendChild(p);p=document.createElement("option");
p.setAttribute("value","blank");mxUtils.write(p,mxResources.get("openInNewWindow"));q.appendChild(p);p=document.createElement("option");p.setAttribute("value","self");mxUtils.write(p,mxResources.get("openInThisWindow"));q.appendChild(p);e&&(e=document.createElement("option"),e.setAttribute("value","frame"),mxUtils.write(e,mxResources.get("openInThisWindow")+" ("+mxResources.get("iframe")+")"),q.appendChild(e));c.appendChild(q);mxUtils.write(c,mxResources.get("borderColor")+":");var t="#0000ff",x=
null;x=mxUtils.button("",mxUtils.bind(this,function(B){this.pickColor(t||"none",function(I){t=I;g()});mxEvent.consume(B)}));g();x.style.padding=mxClient.IS_FF?"4px 2px 4px 2px":"4px";x.style.marginLeft="4px";x.style.height="22px";x.style.width="22px";x.style.position="relative";x.style.top=mxClient.IS_IE||mxClient.IS_IE11||mxClient.IS_EDGE?"6px":"1px";x.className="geColorBtn";c.appendChild(x);mxUtils.br(c);return{getColor:function(){return t},getTarget:function(){return q.value},focus:function(){q.focus()}}};