Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.isDarkMode()?{outBkgClr:Editor.darkColor,cornerClr:Editor.darkColor,strokeClr:"#505759",fontClr:"#BBBBBB",guideClr:"#0088cf"}:{outBkgClr:"#e8e9ed",cornerClr:"#fbfbfb",strokeClr:"#dadce0",fontClr:"#BBBBBB",guideClr:"#0000BB"};R.style[m?"borderRight":"borderBottom"]="0.5px solid "+H.strokeClr;R.style.borderLeft="0.5px solid "+H.strokeClr});this.updateStyle();b.diagramContainer.appendChild(R);mxEvent.disableContextMenu(R);this.editorUiRefresh=b.refresh;b.refresh=function(x){N.editorUiRefresh.apply(b,
arguments);u()};u();var J=document.createElement("canvas");J.width=R.offsetWidth;J.height=R.offsetHeight;R.style.overflow="hidden";J.style.position="relative";R.appendChild(J);var c=J.getContext("2d");this.ui=b;var e=b.editor.graph;this.graph=e;this.container=R;this.canvas=J;var g=function(x,B,I,A,S){x=Math.round(x);B=Math.round(B);I=Math.round(I);A=Math.round(A);c.beginPath();c.moveTo(x+.5,B+.5);c.lineTo(I+.5,A+.5);c.stroke();S&&(m?(c.save(),c.translate(x,B),c.rotate(-Math.PI/2),c.fillText(S,0,0),