Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.commentsWindow.window.setVisible(l);this.commentsWindow.refreshCommentsTime();l&&this.commentsWindow.hasError&&this.commentsWindow.refreshComments()}}));H.setToggleAction(!0);H.setSelectedCallback(mxUtils.bind(this,function(){return null!=this.commentsWindow&&this.commentsWindow.window.isVisible()}));d.editor.addListener("fileLoaded",mxUtils.bind(this,function(){null!=this.commentsWindow&&(this.commentsWindow.destroy(),this.commentsWindow=null)}));this.get("viewPanels").funct=function(l,n){var z=
d.getCurrentFile();d.menus.addMenuItems(l,"toggleShapes format ruler - findReplace layers tags outline -".split(" "),n);d.commentsSupported()&&d.menus.addMenuItems(l,["comments"],n);null!=z&&z.isRealtimeEnabled()&&z.isRealtimeSupported()&&d.menus.addMenuItems(l,["showRemoteCursors"],n);d.menus.addMenuItems(l,["-","fullscreen"],n)};this.put("view",new Menu(mxUtils.bind(this,function(l,n){if("simple"==Editor.currentTheme){var z=d.getCurrentFile();d.menus.addMenuItems(l,["toggleShapes","format"],n);