Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
m.shareCursorPosition);null!=m.showRemoteCursors&&(EditorUi.prototype.showRemoteCursors=m.showRemoteCursors);null!=m.restrictExport&&(DrawioFile.RESTRICT_EXPORT=m.restrictExport)}};Editor.isAutoDarkMode=function(m){return!m&&"auto"==urlParams.dark||Editor.isSettingsEnabled()&&"auto"==mxSettings.settings.darkMode};Editor.isSettingsEnabled=function(){return"undefined"!==typeof window.mxSettings&&(isLocalStorage||mxClient.IS_CHROMEAPP)};Editor.configureFontCss=function(m){if(null!=m){Editor.prototype.fontCss=
m;var C=document.getElementsByTagName("script")[0];if(null!=C&&null!=C.parentNode){var M=document.createElement("style");M.setAttribute("type","text/css");M.appendChild(document.createTextNode(m));C.parentNode.insertBefore(M,C);m=m.split("url(");for(M=1;M<m.length;M++){var ba=m[M].indexOf(")");ba=Editor.trimCssUrl(m[M].substring(0,ba));var V=document.createElement("link");V.setAttribute("rel","preload");V.setAttribute("href",ba);V.setAttribute("as","font");V.setAttribute("crossorigin","");C.parentNode.insertBefore(V,
C)}}}};Editor.trimCssUrl=function(m){return m.replace(RegExp("^[\\s\"']+","g"),"").replace(RegExp("[\\s\"']+$","g"),"")};Editor.GOOGLE_FONTS="https://fonts.googleapis.com/css?family=";Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(m){m=null!=m?m:Editor.GUID_LENGTH;for(var C=[],M=0;M<m;M++)C.push(Editor.GUID_ALPHABET.charAt(Math.floor(Math.random()*Editor.GUID_ALPHABET.length)));return C.join("")};Editor.updateStatusInterval=