Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.hsplit.style.bottom,this.checkTabScrollerOverflow()):(this.diagramContainer.style.left=n.x+"px",this.diagramContainer.style.right="0")}d&&this.editor.graph.sizeDidChange()}else D.apply(this,arguments)};EditorUi.prototype.createShapesPanel=function(d){var g=mxUtils.bind(this,function(t){t=this.createMenu(t,null,"geTitle");t.style.cssText="position:absolute;border-width:1px;cusor:pointer;border-style:none;height:24px;bottom:0px;text-align:center;padding:8px 6px 0 6px;border-top-style:solid;width:50%;height:32px;box-sizing:border-box;font-size:11px;";
d.appendChild(t);return t});if(Editor.enableCustomLibraries&&("1"!=urlParams.embed||"1"==urlParams.libraries))if(null!=this.actions.get("newLibrary"))g=document.createElement("div"),g.style.cssText="position:absolute;border-width:1px;cusor:pointer;border-style:none;height:24px;bottom:0px;text-align:center;padding:8px 6px 0 6px;border-top-style:solid;width:50%;height:32px;box-sizing:border-box;font-size:11px;",g.className="geTitle",mxUtils.write(g,mxResources.get("newLibrary")),d.appendChild(g),mxEvent.addListener(g,
"click",this.actions.get("newLibrary").funct),g=g.cloneNode(!1),g.style.left="50%",g.style.borderLeftStyle="solid",mxUtils.write(g,mxResources.get("openLibrary")),d.appendChild(g),mxEvent.addListener(g,"click",this.actions.get("openLibrary").funct);else{var n=g("newLibrary");n.style.fontSize="11px";n.style.left="0";n=g("openLibraryFrom");n.style.borderLeftStyle="solid";n.style.fontSize="11px";n.style.left="50%"}d.appendChild(this.sidebarContainer);d.style.overflow="hidden"};EditorUi.prototype.createShapesWindow=