Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.hsplit.style.bottom,this.checkTabScrollerOverflow()):(this.diagramContainer.style.left=g.x+"px",this.diagramContainer.style.right="0")}c&&this.editor.graph.sizeDidChange()}else N.apply(this,arguments)};EditorUi.prototype.createShapesPanel=function(c){var e=mxUtils.bind(this,function(q){q=this.createMenu(q,null,"geTitle");q.style.cssText="position:absolute;border-width:1px;cusor:pointer;border-style:none;height:24px;bottom:0px;text-align:center;padding:8px 6px 0 6px;border-top-style:solid;width:50%;height:32px;box-sizing:border-box;font-size:11px;";
c.appendChild(q);return q});if(Editor.enableCustomLibraries&&("1"!=urlParams.embed||"1"==urlParams.libraries))if(null!=this.actions.get("newLibrary"))e=document.createElement("div"),e.style.cssText="position:absolute;border-width:1px;cusor:pointer;border-style:none;height:24px;bottom:0px;text-align:center;padding:8px 6px 0 6px;border-top-style:solid;width:50%;height:32px;box-sizing:border-box;font-size:11px;",e.className="geTitle",mxUtils.write(e,mxResources.get("newLibrary")),c.appendChild(e),mxEvent.addListener(e,
"click",this.actions.get("newLibrary").funct),e=e.cloneNode(!1),e.style.left="50%",e.style.borderLeftStyle="solid",mxUtils.write(e,mxResources.get("openLibrary")),c.appendChild(e),mxEvent.addListener(e,"click",this.actions.get("openLibrary").funct);else{var g=e("newLibrary");g.style.fontSize="11px";g.style.left="0";g=e("openLibraryFrom");g.style.borderLeftStyle="solid";g.style.fontSize="11px";g.style.left="50%"}c.appendChild(this.sidebarContainer);c.style.overflow="hidden"};EditorUi.prototype.createShapesWindow=