Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f=mxUtils.button(f,c);f.insertBefore(y,f.firstChild);f.style.marginTop="6px";f.className="geBigButton";f.style.fontSize="18px";f.style.padding="14px";k.appendChild(l);k.appendChild(b);k.appendChild(f);this.container=k},FontDialog=function(b,e,f,c,k){function l(A){this.style.border="";13==A.keyCode&&v.click()}var x=document.createElement("table"),y=document.createElement("tbody");x.style.marginTop="8px";var E=document.createElement("tr");var D=document.createElement("td");D.colSpan=2;D.style.whiteSpace=