Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var PageSetupDialog=function(b){function e(){var l=R;null!=l&&null!=l.originalSrc&&(l=b.createImageForPageLink(l.originalSrc,null));null!=l&&null!=l.src?(L.style.backgroundImage="url("+l.src+")",L.style.display="inline-block"):(L.style.backgroundImage="",L.style.display="none");L.style.backgroundColor="";null!=V&&V!=mxConstants.NONE&&(L.style.backgroundColor=V,L.style.display="inline-block")}var g=b.editor.graph,n=document.createElement("table");n.style.width="100%";n.style.height="100%";var y=document.createElement("tbody");