Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d){var f=L.apply(this,arguments),l=mxUtils.bind(this,function(){f.refresh();this.restoreOpenLibraries()});Editor.enableCssDarkMode||this.addListener("darkModeChanged",l);this.addListener("sketchModeChanged",l);this.addListener("currentThemeChanged",l);return f};EditorUi.prototype.restoreOpenLibraries=function(){var d=this.openLibraries;this.openLibraries=null;if(null!=d)for(var f=0;f<d.length;f++)this.libraryLoaded(d[f].file,d[f].images,d[f].title,null!=d[f].div?"none"!=d[f].div.style.display:
d[f].expand)};var R=EditorUi.prototype.updateActionStates;EditorUi.prototype.updateActionStates=function(){R.apply(this,arguments);var d=this.editor.graph,f=this.getCurrentFile(),l=this.getSelectionState(),u=this.isDiagramActive(),A="1"==urlParams.embed&&this.editor.graph.isEnabled()||null!=f&&f.isEditable();this.actions.get("undo").setEnabled(this.canUndo()&&A);this.actions.get("redo").setEnabled(this.canRedo()&&A);this.actions.get("autosave").setEnabled(null!=f&&f.isEditable()&&f.isAutosaveOptional());