Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"#ffffff";p.panningHandler.ignoreCell=!0;p.panningHandler.useLeftButtonForPanning=!0;p.minFitScale=null;p.maxFitScale=null;p.centerZoom=!0;var t=mxUtils.parseXml(m),x=b.editor.extractGraphModel(t.documentElement,!0),B=0,I=null,A=p.getGlobalVariable;p.getGlobalVariable=function(l){return"page"==l&&null!=I&&null!=I[B]?I[B].getAttribute("name"):"pagenumber"==l?B+1:"pagecount"==l?null!=I?I.length:1:A.apply(this,arguments)};p.getLinkForCell=function(){return null};m=b.createToolbarButton(Editor.zoomInImage,