Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.defaultEdgeStyle.sketch="1",d.defaultEdgeStyle.curveFitting=Editor.sketchDefaultCurveFitting,d.defaultEdgeStyle.jiggle=Editor.sketchDefaultJiggle,d.defaultEdgeStyle.hachureGap="4"):this.menus.defaultFonts=Menus.prototype.defaultFonts;d.currentVertexStyle=mxUtils.clone(d.defaultVertexStyle);d.currentEdgeStyle=mxUtils.clone(d.defaultEdgeStyle);this.clearDefaultStyle()};EditorUi.prototype.getLinkTitle=function(d){var f=Graph.prototype.getLinkTitle.apply(this,arguments);if(Graph.isPageLink(d)){var l=
d.indexOf(",");0<l&&(f=this.getPageById(d.substring(l+1)),f=null!=f?f.getName():mxResources.get("pageNotFound"))}else"data:"==d.substring(0,5)&&(f=mxResources.get("action"));return f};EditorUi.prototype.handleCustomLink=function(d){if(Graph.isPageLink(d)){var f=d.indexOf(",");if(d=this.getPageById(d.substring(f+1)))this.selectPage(d);else throw Error(mxResources.get("pageNotFound")||"Page not found");}else this.editor.graph.handleCustomLink(d)};EditorUi.prototype.installSettings=function(){if(Editor.isSettingsEnabled()){Editor.pagesVisible=