Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.indexOf(",");0<l&&(f=this.getPageById(d.substring(l+1)),f=null!=f?f.getName():mxResources.get("pageNotFound"))}else"data:"==d.substring(0,5)&&(f=mxResources.get("action"));return f};EditorUi.prototype.handleCustomLink=function(d){if(Graph.isPageLink(d)){var f=d.indexOf(",");if(d=this.getPageById(d.substring(f+1)))this.selectPage(d);else throw Error(mxResources.get("pageNotFound")||"Page not found");}else this.editor.graph.handleCustomLink(d)};EditorUi.prototype.installSettings=function(){if(Editor.isSettingsEnabled()){Editor.pagesVisible=