Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(p,q){var C=c.getCurrentFile();null==C||C.getMode()!=App.MODE_GOOGLE&&C.getMode()!=App.MODE_GITHUB||!/(\.png)$/i.test(C.getTitle())||this.addMenuItems(p,["liveImage","-"],q);this.addMenuItems(p,["embedImage","embedSvg","-","embedHtml"],q);navigator.standalone||c.isOffline()||this.addMenuItems(p,["embedIframe"],q);"1"==urlParams.embed||c.isOffline()||this.addMenuItems(p,"- googleDocs googleSlides googleSheets - microsoftOffice - embedNotion".split(" "),q)})));c.addInsertItem=function(p,q,C,
J){("plantUml"!=J||EditorUi.enablePlantUml&&!c.isOffline())&&p.addItem(C,null,mxUtils.bind(this,function(){if("fromText"==J||"formatSql"==J||"plantUml"==J||"mermaid"==J){var G=new ParseDialog(c,C,J);c.showDialog(G.container,620,420,!0,!1);c.dialog.container.style.overflow="auto"}else G=new CreateGraphDialog(c,C,J),c.showDialog(G.container,620,420,!0,!1);G.init()}),q,null,l())};var A=function(p){k.getModel().beginUpdate();try{p=k.addCell(p),k.fireEvent(new mxEventObject("cellsInserted","cells",[p])),