Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f);this.menus.get("publish").setEnabled(null!=f&&!f.isRestricted());f=this.actions.get("findReplace");f.setEnabled("hidden"!=this.diagramContainer.style.visibility);f.label=mxResources.get("find")+(d.isEnabled()?"/"+mxResources.get("replace"):"");d=d.view.getState(d.getSelectionCell());this.actions.get("editShape").setEnabled(u&&null!=d&&null!=d.shape&&null!=d.shape.stencil)};var V=EditorUi.prototype.destroy;EditorUi.prototype.destroy=function(){null!=this.exportDialog&&(this.exportDialog.parentNode.removeChild(this.exportDialog),
this.exportDialog=null);V.apply(this,arguments)};null!=window.ExportDialog&&(ExportDialog.showXmlOption=!1,ExportDialog.showGifOption=!1,ExportDialog.exportFile=function(d,f,l,u,A,B,F,M){var O=d.editor.graph;if("xml"==l)d.hideDialog(),d.saveData(f,"xml",mxUtils.getXml(d.editor.getGraphXml()),"text/xml");else if("svg"==l)d.hideDialog(),d.saveData(f,"svg",mxUtils.getXml(O.getSvg(u,A,B)),"image/svg+xml");else{var H=d.getFileData(!0,null,null,null,null,!0),ja=O.getGraphBounds(),da=Math.floor(ja.width*