Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d){var g=this.editor.graph;g.defaultEdgeLength=Graph.prototype.defaultEdgeLength;g.defaultGridEnabled=Graph.prototype.defaultGridEnabled;g.defaultPageVisible=Graph.prototype.defaultPageVisible;null!=this.menus&&(this.menus.autoPopup="simple"!=d&&"sketch"!=d);"simple"==d||"sketch"==d?(Editor.fitWindowBorders=new mxRectangle(60,30,30,30),g.defaultEdgeLength=120,null==urlParams.grid&&(g.defaultGridEnabled=!1),null==urlParams.pv&&(g.defaultPageVisible=!1)):Editor.fitWindowBorders=null};EditorUi.prototype.switchCssForTheme=