Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c){"simple"==c||"sketch"==c?null==this.sketchStyleElt&&(this.sketchStyleElt=document.createElement("style"),this.sketchStyleElt.setAttribute("type","text/css"),this.sketchStyleElt.innerHTML=Editor.createMinimalCss(),document.getElementsByTagName("head")[0].appendChild(this.sketchStyleElt)):null!=this.sketchStyleElt&&(this.sketchStyleElt.parentNode.removeChild(this.sketchStyleElt),this.sketchStyleElt=null)};EditorUi.prototype.createWrapperForTheme=function(c){"simple"==c||"sketch"==c?(null==
this.sketchWrapperElt&&(this.sketchWrapperElt=document.createElement("div"),this.sketchWrapperElt.style.cssText="position:absolute;top:0px;left:0px;right:0px;bottom:0px;overflow:hidden;"),"sketch"==c&&(this.sketchWrapperElt.className="geSketch"),this.diagramContainer.parentNode.appendChild(this.sketchWrapperElt),this.sketchWrapperElt.appendChild(this.diagramContainer)):null!=this.sketchWrapperElt&&null!=this.sketchWrapperElt.parentNode&&(this.tabContainer.parentNode.insertBefore(this.diagramContainer,
this.tabContainer),this.sketchWrapperElt.parentNode.removeChild(this.sketchWrapperElt))};EditorUi.prototype.createMainMenuForTheme=function(c){if(("simple"==c||"sketch"==c)&&null==this.sketchMainMenuElt){this.sketchMainMenuElt=document.createElement("div");this.sketchMainMenuElt.style.cssText="position:absolute;padding:9px 12px;overflow:hidden;white-space:nowrap;user-select:none;box-sizing:border-box;";var e=this.createMenu("simple"==c?"view":"diagram","simple"==c?Editor.thinViewImage:Editor.menuImage);