Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"ready";A.postMessage(v,"*");if("json"==urlParams.proto){var H=this.editor.graph.openLink;this.editor.graph.openLink=function(L,F,S){H.apply(this,arguments);A.postMessage(JSON.stringify({event:"openLink",href:L,target:F,allowOpener:S}),"*")}}};EditorUi.prototype.createEmbedButton=function(d,g,n,t){var u="simple"==Editor.currentTheme||"sketch"==Editor.currentTheme||"min"==Editor.currentTheme,v=document.createElement("button");v.setAttribute("title",d+(null!=n?" ("+n+")":""));v.style.marginLeft="6px";