Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"ready";A.postMessage(v,"*");if("json"==urlParams.proto){var H=this.editor.graph.openLink;this.editor.graph.openLink=function(L,F,S){H.apply(this,arguments);A.postMessage(JSON.stringify({event:"openLink",href:L,target:F,allowOpener:S}),"*")}}};EditorUi.prototype.createEmbedButton=function(d,g,n,t){var u="simple"==Editor.currentTheme||"sketch"==Editor.currentTheme||"min"==Editor.currentTheme,v=document.createElement("button");v.setAttribute("title",d+(null!=n?" ("+n+")":""));v.style.marginLeft="6px";
mxUtils.write(v,d);u?(v.className=t?"gePrimaryBtn":"",v.style.marginLeft="8px",v.style.padding="6px"):v.className="geBigButton"+(t?"":" geBigStandardButton");mxEvent.addListener(v,"click",g);return v};EditorUi.prototype.addEmbedButtons=function(){var d=document.createElement("div");d.style.display="inline-flex";d.style.alignItems="center";d.style.marginLeft="auto";"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme&&(d.style.marginRight="66px",d.style["float"]=