Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getSvg=function(k,z,J,W,T,Z,ba,ha,qa,ra,pa,xa,Ca,Ba){var za=null,Ma=null,Qa=null;Editor.enableCssDarkMode||null==this.themes||null==xa||"dark"==xa==("darkTheme"==this.defaultThemeName)||(za=this.stylesheet,Ma=this.shapeForegroundColor,Qa=this.shapeBackgroundColor,this.shapeForegroundColor="darkTheme"==this.defaultThemeName?"#000000":Editor.lightColor,this.shapeBackgroundColor="darkTheme"==this.defaultThemeName?"#ffffff":Editor.darkColor,this.stylesheet=this.getDefaultStylesheet(),
this.refresh());var Pa=null;Editor.enableCssDarkMode&&null!=this.backgroundImage&&(Pa=this.backgroundImage,this.backgroundImage=this.adaptBackgroundPage(Pa,xa));var ta=M.apply(this,arguments);if(Editor.enableCssDarkMode&&("dark"==xa||"auto"==xa)){var Da=Graph.createSvgDarkModeStyle(ta.ownerDocument,xa);ta.getElementsByTagName("defs")[0].appendChild(Da)}var Aa=this.getCustomFonts();if(pa&&0<Aa.length){var ya=ta.ownerDocument;Da=null!=ya.createElementNS?ya.createElementNS(mxConstants.NS_SVG,"style"):
ya.createElement("style");null!=ya.setAttributeNS?Da.setAttributeNS("type","text/css"):Da.setAttribute("type","text/css");for(var Ra="",Wa="",La=0;La<Aa.length;La++){var ab=Aa[La].name,Ea=Aa[La].url;Graph.isCssFontUrl(Ea)?Ra+="@import url("+Ea+");\n":Wa+='@font-face {\nfont-family: "'+ab+'";\nsrc: url("'+Ea+'");\n}\n'}Da.appendChild(ya.createTextNode(Ra+Wa));ta.getElementsByTagName("defs")[0].appendChild(Da)}this.mathEnabled&&(document.body.appendChild(ta),Editor.MathJaxRender(ta),ta.parentNode.removeChild(ta));
null!=Pa&&(this.backgroundImage=Pa);null!=za&&(this.shapeBackgroundColor=Qa,this.shapeForegroundColor=Ma,this.stylesheet=za,this.refresh());return ta};var O=mxCellRenderer.prototype.destroy;mxCellRenderer.prototype.destroy=function(k){O.apply(this,arguments);null!=k.secondLabel&&(k.secondLabel.destroy(),k.secondLabel=null)};mxCellRenderer.prototype.getShapesForState=function(k){return[k.shape,k.text,k.secondLabel,k.control]};var H=mxGraphView.prototype.resetValidationState;mxGraphView.prototype.resetValidationState=