Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M);var X=mxUtils.bind(this,function(Y,Z,ca){W.innerText="";mxUtils.write(W,Math.round(100*t.editor.graph.view.scale*(null!=ca?ca:1))+"%")});t.editor.graph.view.addListener(mxEvent.EVENT_SCALE,X);t.editor.addListener("resetGraphView",X);t.editor.addListener("pageSelected",X);t.editor.graph.addListener("zoomPreview",mxUtils.bind(this,function(Y,Z){X(Y,Z,Z.getProperty("factor"))}))})(U);var T=t.setGraphEnabled;t.setGraphEnabled=function(){T.apply(this,arguments);null!=this.tabContainer&&(U.style.visibility=
this.tabContainer.style.visibility,this.diagramContainer.style.bottom="0"!=urlParams.pages&&"hidden"!=this.tabContainer.style.visibility?this.tabContainerHeight+"px":"0px")}}p.appendChild(B);p.appendChild(t.diagramContainer);q.appendChild(p);t.updateTabContainer();!EditorUi.windowed&&1E3<=d&&b(this,!0);p.appendChild(t.tabContainer);g();mxEvent.addListener(window,"resize",function(){g();null!=t.sidebarWindow&&t.sidebarWindow.window.fit();null!=t.formatWindow&&t.formatWindow.window.fit();null!=t.actions.outlineWindow&&