Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
y.getGlobalVariable=function(V){return"page"==V&&null!=D&&null!=D[z]?D[z].getAttribute("name"):"pagenumber"==V?z+1:"pagecount"==V?null!=D?D.length:1:M.apply(this,arguments)};y.getLinkForCell=function(){return null};Editor.MathJaxRender&&y.model.addListener(mxEvent.CHANGE,mxUtils.bind(this,function(V,X){b.editor.graph.mathEnabled&&Editor.MathJaxRender(y.container)}));var I={lines:11,length:15,width:6,radius:10,corners:1,rotate:0,direction:1,color:Editor.isDarkMode()?"#c0c0c0":"#000",speed:1.4,trail:60,