Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(m){m=m.getElementsByTagName("defs");if(null!=m&&0<m.length)for(var C=document.getElementsByTagName("style"),M=0;M<C.length;M++){var ba=mxUtils.getTextContent(C[M]);0>ba.indexOf("mxPageSelector")&&0<ba.indexOf("MathJax")&&m[0].appendChild(C[M].cloneNode(!0))}};Editor.prototype.addFontCss=function(m,C){C=null!=C?C:this.absoluteCssFonts(this.fontCss);if(null!=C){var M=m.getElementsByTagName("defs"),ba=m.ownerDocument;0==M.length?(M=null!=ba.createElementNS?ba.createElementNS(mxConstants.NS_SVG,
"defs"):ba.createElement("defs"),null!=m.firstChild?m.insertBefore(M,m.firstChild):m.appendChild(M)):M=M[0];m=null!=ba.createElementNS?ba.createElementNS(mxConstants.NS_SVG,"style"):ba.createElement("style");m.setAttribute("type","text/css");mxUtils.setTextContent(m,C);M.appendChild(m)}};Editor.prototype.isExportToCanvas=function(){return mxClient.IS_CHROMEAPP||this.useCanvasForExport};Editor.prototype.getMaxCanvasScale=function(m,C,M){var ba=mxClient.IS_FF?8192:16384;return Math.min(M,Math.min(ba/