Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c.style.textAlign="right";e=document.createElement("div");e.className="geToolbarContainer";e.style.cssText="box-shadow:none !important;background-color:transparent;padding:2px;border-style:none !important;bottom:30px;";this.init=function(){function l(D){if(null!=D){var M=D.getAttribute("background");if(null==M||""==M||M==mxConstants.NONE)M=Editor.isDarkMode()?"transparent":"#ffffff";q.style.backgroundColor=M;(new mxCodec(D.ownerDocument)).decode(D,p.getModel());p.maxFitScale=1;p.fit(8);p.center()}return D}