Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
q;for(q in urlParams)0>mxUtils.indexOf(g,q)&&(c=0==e?c+"?":c+"&",null!=urlParams[q]&&(c+=q+"="+urlParams[q],e++))}return c};EditorUi.prototype.showLinkDialog=function(c,e,g,q,p){c=new LinkDialog(this,c,e,g,!0,q,p);this.showDialog(c.container,560,130,!0,!0);c.init()};EditorUi.prototype.getServiceCount=function(c){var e=1;null==this.drive&&"function"!==typeof window.DriveClient||e++;null==this.dropbox&&"function"!==typeof window.DropboxClient||e++;null==this.oneDrive&&"function"!==typeof window.OneDriveClient||
e++;null!=this.gitHub&&e++;null!=this.gitLab&&e++;c&&isLocalStorage&&"1"==urlParams.browser&&e++;return e};EditorUi.prototype.updateUi=function(){this.updateButtonContainer();this.updateActionStates();var c=this.getCurrentFile(),e=null!=c||"1"==urlParams.embed&&this.editor.graph.isEnabled();this.menus.get("viewPanels").setEnabled(e);this.menus.get("viewZoom").setEnabled(e);var g=("1"!=urlParams.embed||"1"==urlParams.embedRT||!this.editor.graph.isEnabled())&&(null==c||c.isRestricted());this.actions.get("makeCopy").setEnabled(!g);