Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Menus.prototype.init=function(){function m(l,n,z){this.ui=l;this.previousExtFonts=this.extFonts=n;this.prevCustomFonts=this.customFonts=z}f.apply(this,arguments);var d=this.editorUi,u=d.editor.graph,v=mxUtils.bind(u,u.isEnabled),E=("1"!=urlParams.embed&&"0"!=urlParams.gapi||"1"==urlParams.embed&&"1"==urlParams.gapi)&&mxClient.IS_SVG&&isLocalStorage&&(null==document.documentMode||10<=document.documentMode),F=("1"!=urlParams.embed&&"0"!=urlParams.db||"1"==urlParams.embed&&"1"==urlParams.db)&&mxClient.IS_SVG&&