Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(null!=t.hoverIcons){var z=t.hoverIcons.update;t.hoverIcons.update=function(){x.freehand.isDrawing()||z.apply(this,arguments)}}if(null!=x.freehand){var C=x.freehand.createStyle;x.freehand.createStyle=function(W){return C.apply(this,arguments)+"sketch=0;"}}t.editor.addListener("statusChanged",mxUtils.bind(this,function(){t.setStatusText(t.editor.getStatus())}));t.setStatusText(t.editor.getStatus());var D=t.menus.get("viewZoom");if(null!=D){var M=function(W){if(mxEvent.isAltDown(W))t.hideCurrentMenu(),