Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f));d.setCellStyles(mxConstants.STYLE_CLIP_PATH,K,[F]);d.setCellStyles(mxConstants.STYLE_ASPECT,"fixed",[F])}finally{d.getModel().endUpdate()}}var n=this.editorUi,y=n.editor,q=y.graph,E=function(){return Action.prototype.isEnabled.apply(this,arguments)&&q.isEnabled()};this.addAction("new...",function(){q.openLink(n.getUrl())});this.addAction("open...",function(){window.openNew=!0;window.openKey="open";n.openFile()});this.put("smartFit",new Action(mxResources.get("fitWindow")+" / "+mxResources.get("resetView"),