Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.lightboxHost+"/?client=1"+(null!=e?"&page="+e:"")+(p?"&edit=_blank":"")+(t?"&layers=1":"")+"');}}})(this);"),n+="cursor:pointer;"),c&&(c=parseInt(B.getAttribute("width")),p=parseInt(B.getAttribute("height")),B.setAttribute("viewBox","-0.5 -0.5 "+c+" "+p),n+="max-width:100%;max-height:"+p+"px;",B.removeAttribute("height")),""!=n&&B.setAttribute("style",n),this.editor.addFontCss(B),this.editor.graph.mathEnabled&&this.editor.addMathCss(B),x(mxUtils.getXml(B))};EditorUi.prototype.timeSince=function(c){c=
Math.floor((new Date-c)/1E3);var e=Math.floor(c/31536E3);if(1<e)return e+" "+mxResources.get("years");e=Math.floor(c/2592E3);if(1<e)return e+" "+mxResources.get("months");e=Math.floor(c/86400);if(1<e)return e+" "+mxResources.get("days");e=Math.floor(c/3600);if(1<e)return e+" "+mxResources.get("hours");e=Math.floor(c/60);return 1<e?e+" "+mxResources.get("minutes"):1==e?e+" "+mxResources.get("minute"):null};EditorUi.prototype.decodeNodeIntoGraph=function(c,e){if(null!=c){var g=null;if("diagram"==c.nodeName)g=