Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var d=Menus.prototype.createMenubar;Menus.prototype.createMenubar=function(p){var q=d.apply(this,arguments);if(("1"!=urlParams.embed||"1"==urlParams.atlas)&&null!=q&&Editor.enableSimpleTheme&&"atlassian"!=c.getServiceName()){var C=this.get("appearance");if(null!=C){var J=q.addMenu("",C.funct);J.setAttribute("title",mxResources.get("appearance"));J.className="geToolbarButton geAdaptiveAsset";J.style.backgroundPosition="center center";J.style.backgroundRepeat="no-repeat";J.style.backgroundSize="100% 100%";
J.style.display="inline-block";J.style.cursor="pointer";J.style.zIndex="1";J.style.position="absolute";J.style.height="18px";J.style.width="18px";"atlas"==Editor.currentTheme?(J.style.filter="invert(100%)",J.style.right="11px",J.style.top="10px"):(J.style.right="10px",J.style.top="5px");document.body.appendChild(J);q.langIcon=J;C=mxUtils.bind(this,function(){var G=window.innerWidth||document.documentElement.clientWidth||document.body.clientWidth;J.style.display="atlas"==Editor.currentTheme||"min"==
Editor.currentTheme||"sketch"==Editor.currentTheme?"none":"";J.style.backgroundImage="simple"==Editor.currentTheme?750>G?"url("+Editor.thinDoubleArrowRightImage+")":"url("+(Editor.isDarkMode()?Editor.thinDarkImage:Editor.thinLightImage)+")":"url("+(Editor.isDarkMode()?Editor.darkModeImage:Editor.lightModeImage)+")"});this.editorUi.addListener("currentThemeChanged",C);this.editorUi.addListener("darkModeChanged",C);mxEvent.addListener(window,"resize",C);C()}}return q}}c.customLayoutConfig=[{layout:"mxHierarchicalLayout",