Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(null!=t.hoverIcons){var z=t.hoverIcons.update;t.hoverIcons.update=function(){x.freehand.isDrawing()||z.apply(this,arguments)}}if(null!=x.freehand){var C=x.freehand.createStyle;x.freehand.createStyle=function(W){return C.apply(this,arguments)+"sketch=0;"}}t.editor.addListener("statusChanged",mxUtils.bind(this,function(){t.setStatusText(t.editor.getStatus())}));t.setStatusText(t.editor.getStatus());var D=t.menus.get("viewZoom");if(null!=D){var M=function(W){if(mxEvent.isAltDown(W))t.hideCurrentMenu(),
t.actions.get("customZoom").funct(),mxEvent.consume(W);else if("geMenuItem"==mxEvent.getSource(W).className||mxEvent.isShiftDown(W))t.hideCurrentMenu(),t.actions.get("smartFit").funct(),mxEvent.consume(W)},K=t.actions.get("zoomIn"),O=t.actions.get("zoomOut"),V=t.actions.get("resetView"),k=t.actions.get("undo"),y=t.actions.get("redo"),G=c("",k.funct,null,mxResources.get("undo")+" ("+k.shortcut+")",k,Editor.undoImage),P=c("",y.funct,null,mxResources.get("redo")+" ("+y.shortcut+")",y,Editor.redoImage),