Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c){var e=this.editor.graph.view.scale,g=this.editor.graph.view.translate,q=mxUtils.getOffset(this.diagramContainer);this.diagramContainer.scrollLeft=c.x+q.x+(g.x-c.tx)*e;this.diagramContainer.scrollTop=c.y+q.y+(g.y-c.ty)*e};EditorUi.prototype.setInlineFullscreen=function(c){Editor.inlineFullscreen!=c&&(this.diagramContainer.setAttribute("data-scrollState",JSON.stringify(this.saveScrollState())),(window.opener||window.parent).postMessage(JSON.stringify({event:"resize",fullscreen:c,rect:this.diagramContainer.getBoundingClientRect()}),