Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ChangePageSetup.prototype.execute=function(){var b=this.ui.editor.graph;if(!this.ignoreColor){this.color=this.previousColor;var e=b.background;this.ui.setBackgroundColor(this.previousColor);this.previousColor=e}if(!this.ignoreImage){this.image=this.previousImage;e=b.backgroundImage;var g=this.previousImage;null!=g&&null!=g.src&&"data:page/id,"==g.src.substring(0,13)&&(g=this.ui.createImageForPageLink(g.src,this.ui.currentPage));this.ui.setBackgroundImage(g);this.previousImage=e}null!=this.previousFormat&&
(this.format=this.previousFormat,e=b.pageFormat,this.previousFormat.width!=e.width||this.previousFormat.height!=e.height)&&(this.ui.setPageFormat(this.previousFormat),this.previousFormat=e);null!=this.foldingEnabled&&this.foldingEnabled!=this.ui.editor.graph.foldingEnabled&&(this.ui.setFoldingEnabled(this.foldingEnabled),this.foldingEnabled=!this.foldingEnabled);null!=this.previousPageScale&&(b=this.ui.editor.graph.pageScale,this.previousPageScale!=b&&(this.ui.setPageScale(this.previousPageScale),
this.previousPageScale=b))};(function(){var b=new mxObjectCodec(new ChangePageSetup,["ui","previousColor","previousImage","previousFormat","previousPageScale"]);b.afterDecode=function(e,g,n){n.previousColor=n.color;n.previousImage=n.image;n.previousFormat=n.format;n.previousPageScale=n.pageScale;null!=n.foldingEnabled&&(n.foldingEnabled=!n.foldingEnabled);return n};mxCodecRegistry.register(b)})();