Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getGlobalVariable;Graph.prototype.getGlobalVariable=function(k){var z=F.apply(this,arguments);null==z&&null!=this.globalVars&&(z=this.globalVars[k]);return z};Graph.prototype.getDefaultStylesheet=function(){if(null==this.defaultStylesheet){var k=this.themes["default-style2"];this.defaultStylesheet=(new mxCodec(k.ownerDocument)).decode(k)}return this.defaultStylesheet};Graph.prototype.isViewer=function(){return urlParams.viewer};Graph.prototype.adaptBackgroundPage=function(k,z){if(null!=
k&&null!=k.src){var J=Graph.getSvgFromDataUri(k.src);if(null!=J)try{var W=(new DOMParser).parseFromString(J,"text/xml"),T=W.getElementsByTagName("style");for(J=0;J<T.length;J++)if(T[J].innerHTML==Graph.svgDarkModeCss){T[J].parentNode.removeChild(T[J]);break}if("dark"==z||"auto"==z){var Z=Graph.createSvgDarkModeStyle(W,z);W.getElementsByTagName("defs")[0].appendChild(Z)}k=new mxImage(Editor.createSvgDataUri(mxUtils.getXml(W.documentElement)),k.width,k.height,k.x,k.y)}catch(ba){}}return k};var M=Graph.prototype.getSvg;