Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
u.style.backgroundSize="100% 100%";u.style.display="inline-block";u.style.cursor="pointer";u.style.marginLeft="6px";u.style.width=t+"px";u.style.height=t+"px";null!=n&&(mxEvent.addListener(u,mxClient.IS_POINTER?"pointerdown":"mousedown",mxUtils.bind(this,function(v){v.preventDefault()})),mxEvent.addListener(u,"click",function(v){"disabled"!=u.getAttribute("disabled")&&n(v);mxEvent.consume(v)}));return u};EditorUi.prototype.createMenuItem=function(d,g,n){var t=this.actions.get(d),u=null!=t?t.funct:
null,v=this.createToolbarButton(g,mxResources.get(d)+(null!=t&&null!=t.shortcut?" ("+t.shortcut+")":""),u);null==t||n||(d=function(){t.isEnabled()?(v.removeAttribute("disabled"),v.style.cursor="pointer"):(v.setAttribute("disabled","disabled"),v.style.cursor="default");v.style.opacity=t.isEnabled()?"":"0.2"},this.editor.graph.addListener("enabledChanged",d),t.addListener("stateChanged",d),d());return v};EditorUi.prototype.createFormatWindow=function(){if(null==this.formatWindow){var d=Math.max(10,