Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.addLanguageMenu=function(b,f,m){var d=null;null!=this.menus.get("language")&&(d=document.createElement("div"),d.setAttribute("title",mxResources.get("language")),d.className="atlas"!=Editor.currentTheme?"geIcon geAdaptiveAsset":"",d.style.backgroundImage="url("+Editor.globeImage+")",d.style.backgroundPosition="right center",d.style.backgroundRepeat="no-repeat",d.style.backgroundSize="19px 19px",d.style.width="19px",d.style.height="19px",mxUtils.setOpacity(d,40),d.style.position="absolute",
d.style.cursor="pointer",d.style.bottom="20px",d.style.right=null!=m?m:"22px",f&&(d.style.direction="rtl",d.style.textAlign="right",d.style.right=null!=m?m:"24px",f=document.createElement("span"),f.style.display="inline-block",f.style.fontSize="12px",f.style.margin="2px 24px 0 0",f.style.userSelect="none",mxUtils.write(f,mxResources.get("language")),d.appendChild(f),f.className="atlas"!=Editor.currentTheme?"geAdaptiveAsset":""),mxEvent.addListener(d,"click",mxUtils.bind(this,function(u){this.editor.graph.popupMenuHandler.hideMenu();
var v=new mxPopupMenu(this.menus.get("language").funct);v.div.className+=" geMenubarMenu";v.smartSeparators=!0;v.showDisabled=!0;v.autoExpand=!0;v.hideMenu=mxUtils.bind(this,function(){mxPopupMenu.prototype.hideMenu.apply(v,arguments);v.destroy()});var E=mxUtils.getOffset(d);v.popup(E.x,E.y+d.offsetHeight,null,u);this.setCurrentMenu(v)})),b.appendChild(d));return d};