Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.installStatusMinimizer=function(c){c=null!=c?c:this.statusContainer.parentNode;var e=!1;mxEvent.addListener(c,"mouseenter",mxUtils.bind(this,function(){"sketch"==Editor.currentTheme&&""!=this.editor.getStatus()&&(this.statusContainer.style.display="inline-flex")}));mxEvent.addListener(c,"mouseleave",mxUtils.bind(this,function(){"sketch"!=Editor.currentTheme||e||(this.statusContainer.style.display="none")}));var g=mxUtils.bind(this,function(){if("sketch"==Editor.currentTheme){var q=
null!=this.statusContainer.firstChild&&"function"===typeof this.statusContainer.firstChild.getAttribute?this.statusContainer.firstChild:null;e=null!=q&&null!=q.getAttribute("class");if(!e&&null!=q){q=q.getAttribute("title");var p=this.getCurrentFile();p=null!=p?p.savingStatusKey:DrawioFile.prototype.savingStatusKey;q==mxResources.get(p)+"..."&&(this.statusContainer.innerHTML='<div><img title="'+mxUtils.htmlEntities(mxResources.get(p))+'..."src="'+Editor.tailSpin+'"></div>',e=!0)}this.statusContainer.style.display=
"none";q=32>=c.clientWidth;c.style.visibility=q&&""==this.editor.getStatus()?"hidden":"";if(q||e)this.statusContainer.style.display="inline-flex",e=!0}else"simple"==Editor.currentTheme?(this.statusContainer.style.display="inline-flex",this.statusContainer.style.display=0==this.statusContainer.clientWidth?"none":"inline-flex"):this.statusContainer.style.display="inline-flex"});this.editor.addListener("statusChanged",g);g()};EditorUi.prototype.switchTheme=function(c){this.isDefaultTheme(c)&&null!=this.formatContainer&&