Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.installResizeHandler=function(b,e,g){e&&(b.window.setSize=function(y,q){if(!this.minimized){var E=window.innerHeight||document.body.clientHeight||document.documentElement.clientHeight;y=Math.min(y,(window.innerWidth||document.body.clientWidth||document.documentElement.clientWidth)-this.getX());q=Math.min(q,E-this.getY())}mxWindow.prototype.setSize.apply(this,arguments)});b.window.setLocation=function(y,q){var E=window.innerWidth||document.body.clientWidth||document.documentElement.clientWidth,
N=window.innerHeight||document.body.clientHeight||document.documentElement.clientHeight,T=parseInt(this.div.style.width),F=parseInt(this.div.style.height);y=Math.max(0,Math.min(y,E-T));q=Math.max(0,Math.min(q,N-F));this.getX()==y&&this.getY()==q||mxWindow.prototype.setLocation.apply(this,arguments);e&&!this.minimized&&this.setSize(T,F)};var n=mxUtils.bind(this,function(){var y=b.window.getX(),q=b.window.getY();b.window.setLocation(y,q)});mxEvent.addListener(window,"resize",n);b.destroy=function(){mxEvent.removeListener(window,
"resize",n);b.window.destroy();null!=g&&g()}};function ChangeGridColor(b,e){this.ui=b;this.color=e}ChangeGridColor.prototype.execute=function(){var b=this.ui.editor.graph.view.gridColor;this.ui.setGridColor(this.color);this.color=b};(function(){var b=new mxObjectCodec(new ChangeGridColor,["ui"]);mxCodecRegistry.register(b)})();