Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(null==this.getCurrentFile()?window.location.hash="#U"+encodeURIComponent(p):window.openWindow((mxClient.IS_CHROMEAPP?EditorUi.drawHost+"/":"https://"+location.host+"/")+window.location.search+"#U"+encodeURIComponent(p)))))}else this.openLocalFile(p,null,!0)}q.stopPropagation();q.preventDefault()}))};EditorUi.prototype.highlightElement=function(c){var e=0,g=0;if(null==c){var q=document.body;var p=document.documentElement;var t=(q.clientWidth||p.clientWidth)-3;q=Math.max(q.clientHeight||0,p.clientHeight)-
3}else e=c.offsetTop,g=c.offsetLeft,t=c.clientWidth,q=c.clientHeight;p=document.createElement("div");p.style.zIndex=mxPopupMenu.prototype.zIndex+2;p.style.border="3px dotted rgb(254, 137, 12)";p.style.pointerEvents="none";p.style.position="absolute";p.style.top=e+"px";p.style.left=g+"px";p.style.width=Math.max(0,t-3)+"px";p.style.height=Math.max(0,q-3)+"px";null!=c&&c.parentNode==this.editor.graph.container?this.editor.graph.container.appendChild(p):document.body.appendChild(p);return p};EditorUi.prototype.stringToCells=