Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(t){t.preventDefault()})),mxEvent.addListener(n,"click",function(t){"disabled"!=n.getAttribute("disabled")&&l(t);mxEvent.consume(t)}));return n};EditorUi.prototype.createMenuItem=function(c,e,l){var p=this.actions.get(c),n=null!=p?p.funct:null,t=this.createToolbarButton(e,mxResources.get(c)+(null!=p&&null!=p.shortcut?" ("+p.shortcut+")":""),n);null==p||l||(c=function(){p.isEnabled()?(t.removeAttribute("disabled"),t.style.cursor="pointer"):(t.setAttribute("disabled","disabled"),t.style.cursor=
"default");t.style.opacity=p.isEnabled()?"":"0.2"},this.editor.graph.addListener("enabledChanged",c),p.addListener("stateChanged",c),c());return t};EditorUi.prototype.createFormatWindow=function(){if(null==this.formatWindow){var c=Math.max(10,this.diagramContainer.parentNode.clientWidth-256),e="1"==urlParams.embedInline?580:"1"==urlParams.sketch?580:Math.min(566,this.editor.graph.container.clientHeight-10);this.formatWindow=new WrapperWindow(this,mxResources.get("format"),c,60,240,e,mxUtils.bind(this,