Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"simple"==Editor.currentTheme&&this.addMenuItems(L,["zoomIn","zoomOut","-"],null,g);I.apply(this,arguments);e.isSelectionEmpty()||null==c.addSelectionToScratchpad||this.addMenuItems(L,["-","addToScratchpad"],null,g);e.isSelectionEmpty()&&"simple"==Editor.currentTheme&&this.addMenuItems(L,["-","exitGroup","home"],null,g)};var B=Menus.prototype.addPopupMenuEditItems;this.menus.addPopupMenuEditItems=function(L,U,g){if(c.editor.graph.isSelectionEmpty())B.apply(this,arguments),c.menus.addMenuItems(L,["copyAsImage"],
null,g);else if(this.isShowCellEditItems()?this.addPopupDeleteItem(L,U,g):this.addPopupMenuArrangeItems(L,U,g),this.addMenuItems(L,"- cut copy copyAsImage duplicate -".split(" "),null,g),this.isShowCellEditItems()||this.addPopupDeleteItem(L,U,g),this.addMenuItems(L,["lockUnlock","-"],null,g),!this.isShowStyleItems()){if(1==e.getSelectionCount()&&!e.isCellLocked(U)&&e.isCellEditable(U)&&(this.addSubmenu("editCell",L,null,mxResources.get("edit")),L.addSeparator(),e.getModel().isEdge(U))){this.addSubmenu("line",
L);var y=e.getModel().getGeometry(U);null!=y&&null!=y.points&&0<y.points.length&&this.addMenuItems(L,["clearWaypoints"],null,g)}1==e.getSelectionCount()&&this.addMenuItems(L,["enterGroup"],null,g);y=c.getSelectionState();null!=y.mergeCell?this.addMenuItem(L,"mergeCells"):(1<y.style.colspan||1<y.style.rowspan)&&this.addMenuItem(L,"unmergeCells")}};this.menus.isShowStyleItems=function(){return"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme};this.menus.isShowHistoryItems=