Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"simple"==Editor.currentTheme&&this.addMenuItems(O,["zoomIn","zoomOut","-"],null,T);L.apply(this,arguments);g.isSelectionEmpty()||null==d.addSelectionToScratchpad||this.addMenuItems(O,["-","addToScratchpad"],null,T);g.isSelectionEmpty()&&"simple"==Editor.currentTheme&&this.addMenuItems(O,["-","exitGroup","home"],null,T)};var F=Menus.prototype.addPopupMenuEditItems;this.menus.addPopupMenuEditItems=function(O,N,T){if(d.editor.graph.isSelectionEmpty())F.apply(this,arguments),d.menus.addMenuItems(O,["copyAsImage"],
null,T);else if(this.isShowCellEditItems()?this.addPopupDeleteItem(O,N,T):this.addPopupMenuArrangeItems(O,N,T),this.addMenuItems(O,"- cut copy copyAsImage duplicate -".split(" "),null,T),this.isShowCellEditItems()||this.addPopupDeleteItem(O,N,T),this.addMenuItems(O,["lockUnlock","-"],null,T),!this.isShowStyleItems()){if(1==g.getSelectionCount()&&!g.isCellLocked(N)&&g.isCellEditable(N)&&(this.addSubmenu("editCell",O,null,mxResources.get("edit")),O.addSeparator(),g.getModel().isEdge(N))){this.addSubmenu("line",
O);var m=g.getModel().getGeometry(N);null!=m&&null!=m.points&&0<m.points.length&&this.addMenuItems(O,["clearWaypoints"],null,T)}1==g.getSelectionCount()&&this.addMenuItems(O,["enterGroup"],null,T);m=d.getSelectionState();null!=m.mergeCell?this.addMenuItem(O,"mergeCells"):(1<m.style.colspan||1<m.style.rowspan)&&this.addMenuItem(O,"unmergeCells")}};this.menus.isShowStyleItems=function(){return"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme};this.menus.isShowHistoryItems=