Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
P);var X=mxUtils.bind(this,function(Y,Z,ca){V.innerText="";mxUtils.write(V,Math.round(100*v.editor.graph.view.scale*(null!=ca?ca:1))+"%")});v.editor.graph.view.addListener(mxEvent.EVENT_SCALE,X);v.editor.addListener("resetGraphView",X);v.editor.addListener("pageSelected",X);v.editor.graph.addListener("zoomPreview",mxUtils.bind(this,function(Y,Z){X(Y,Z,Z.getProperty("factor"))}))})(W);var Q=v.setGraphEnabled;v.setGraphEnabled=function(){Q.apply(this,arguments);null!=this.tabContainer&&(W.style.visibility=
this.tabContainer.style.visibility,this.diagramContainer.style.bottom="0"!=urlParams.pages&&"hidden"!=this.tabContainer.style.visibility?this.tabContainerHeight+"px":"0px")}}u.appendChild(H);u.appendChild(v.diagramContainer);t.appendChild(u);v.updateTabContainer();!EditorUi.windowed&&1E3<=c&&b(this,!0);u.appendChild(v.tabContainer);n();mxEvent.addListener(window,"resize",function(){n();null!=v.sidebarWindow&&v.sidebarWindow.window.fit();null!=v.formatWindow&&v.formatWindow.window.fit();null!=v.actions.outlineWindow&&