Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(l,n){var z=d.getCurrentFile();null==z||z.getMode()!=App.MODE_GOOGLE&&z.getMode()!=App.MODE_GITHUB||!/(\.png)$/i.test(z.getTitle())||this.addMenuItems(l,["liveImage","-"],n);this.addMenuItems(l,["embedImage","embedSvg","-","embedHtml"],n);navigator.standalone||d.isOffline()||this.addMenuItems(l,["embedIframe"],n);"1"==urlParams.embed||d.isOffline()||this.addMenuItems(l,"- googleDocs googleSlides googleSheets - microsoftOffice - embedNotion".split(" "),n)})));d.addInsertItem=function(l,n,z,
C){("plantUml"!=C||EditorUi.enablePlantUml&&!d.isOffline())&&l.addItem(z,null,mxUtils.bind(this,function(){if("fromText"==C||"formatSql"==C||"plantUml"==C||"mermaid"==C){var D=new ParseDialog(d,z,C);d.showDialog(D.container,620,420,!0,!1);d.dialog.container.style.overflow="auto"}else D=new CreateGraphDialog(d,z,C),d.showDialog(D.container,620,420,!0,!1);D.init()}),n,null,v())};var x=function(l){u.getModel().beginUpdate();try{l=u.addCell(l),u.fireEvent(new mxEventObject("cellsInserted","cells",[l])),