Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
url:aa}),this.editorUi.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts)))}finally{O.getModel().endUpdate()}}}));this.editorUi.showDialog(X.container,380,Editor.enableWebFonts?250:180,!0,!0);X.init()}),y,null,!0)})))}})();function DiagramPage(b,e){this.node=b;null!=e?this.node.setAttribute("id",e):null==this.getId()&&this.node.setAttribute("id",Editor.guid())}DiagramPage.prototype.node=null;DiagramPage.prototype.root=null;DiagramPage.prototype.viewState=null;DiagramPage.prototype.getId=function(){return this.node.getAttribute("id")};DiagramPage.prototype.getName=function(){return this.node.getAttribute("name")};