Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addMenuItems(l,["-","revisionHistory"],y),null!=J&&null!=c.fileNode&&"1"!=urlParams.embedInline&&(G=null!=J.getTitle()?J.getTitle():c.defaultFilename,(J.constructor==DriveFile&&null!=J.sync&&J.sync.isConnected()||!/(\.html)$/i.test(G))&&this.addMenuItems(l,["-","properties"])),this.addMenuItems(l,["-","pageSetup"],y),mxClient.IS_IOS&&navigator.standalone||this.addMenuItems(l,["print"],y),this.addMenuItems(l,["-","close"])})));f.prototype.execute=function(){var l=this.ui.editor.graph;this.customFonts=
this.prevCustomFonts;this.prevCustomFonts=this.ui.menus.customFonts;this.ui.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts));this.extFonts=this.previousExtFonts;for(var y=l.extFonts,J=0;null!=y&&J<y.length;J++){var G=document.getElementById("extFont_"+y[J].name);null!=G&&G.parentNode.removeChild(G)}l.extFonts=[];for(J=0;null!=this.previousExtFonts&&J<this.previousExtFonts.length;J++)this.ui.editor.graph.addExtFont(this.previousExtFonts[J].name,this.previousExtFonts[J].url);
this.previousExtFonts=y};this.put("fontFamily",new Menu(mxUtils.bind(this,function(l,y){for(var J=mxUtils.bind(this,function(O,W,X,Z,Y){var ba=c.editor.graph;Z=this.styleChange(l,Z||O,"1"!=urlParams["ext-fonts"]?[mxConstants.STYLE_FONTFAMILY,"fontSource","FType"]:[mxConstants.STYLE_FONTFAMILY],"1"!=urlParams["ext-fonts"]?[O,null!=W?encodeURIComponent(W):null,null]:[O],null,y,function(){"1"!=urlParams["ext-fonts"]?ba.setFont(O,W):(document.execCommand("fontname",!1,O),ba.addExtFont(O,W));c.fireEvent(new mxEventObject("styleChanged",