Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Na=k.getCurrentFile();null!=Na&&(Ja.title=Na.getTitle());var hb=Ja.writeHead;Ja.writeHead=function(Za){hb.apply(this,arguments);mxClient.IS_GC&&(Za.writeln('<style type="text/css">'),Za.writeln("@media print {"),Za.writeln(".MathJax svg { shape-rendering: crispEdges; }"),Za.writeln("}"),Za.writeln("</style>"));null!=k.editor.fontCss&&(Za.writeln('<style type="text/css">'),Za.writeln(k.editor.fontCss),Za.writeln("</style>"));for(var cb=ya.getCustomFonts(),bb=0;bb<cb.length;bb++){var eb=cb[bb].name,
db=cb[bb].url;Graph.isCssFontUrl(db)?Za.writeln('<link rel="stylesheet" href="'+mxUtils.htmlEntities(db)+'" charset="UTF-8" type="text/css">'):(Za.writeln('<style type="text/css">'),Za.writeln('@font-face {\nfont-family: "'+mxUtils.htmlEntities(eb)+'";\nsrc: url("'+mxUtils.htmlEntities(db)+'");\n}'),Za.writeln("</style>"))}};if("undefined"!==typeof MathJax){var ib=Ja.renderPage;Ja.renderPage=function(Za,cb,bb,eb,db,kb){var jb=mxClient.NO_FO,fb=ib.apply(this,arguments);mxClient.NO_FO=jb;this.graph.mathEnabled?