Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxClient.IS_EDGE?"6px":"1px";F.className="geColorBtn";d.appendChild(F);mxUtils.br(d);return{getColor:function(){return B},getTarget:function(){return u.value},focus:function(){u.focus()}}};EditorUi.prototype.createUrlParameters=function(d,f,l,u,A,B,F){F=null!=F?F:[];u&&("https://viewer.diagrams.net"==EditorUi.lightboxHost&&"1"!=urlParams.dev||F.push("lightbox=1"),"auto"!=d&&F.push("target="+d),null!=f&&f!=mxConstants.NONE&&F.push("highlight="+("#"==f.charAt(0)?f.substring(1):f)),null!=A&&0<A.length&&
F.push("edit="+encodeURIComponent(A)),B&&F.push("layers=1"),this.editor.graph.foldingEnabled&&F.push("nav=1"));l&&null!=this.currentPage&&null!=this.pages&&this.currentPage!=this.pages[0]&&F.push("page-id="+this.currentPage.getId());return F};EditorUi.prototype.createLink=function(d,f,l,u,A,B,F,M,O,H){O=this.createUrlParameters(d,f,l,u,A,B,O);d=this.getCurrentFile();f=!0;null!=F?l="#U"+encodeURIComponent(F):(d=this.getCurrentFile(),M||null==d||d.constructor!=window.DriveFile?l="#R"+encodeURIComponent(l?