Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.installStatusMinimizer=function(d){d=null!=d?d:this.statusContainer.parentNode;var g=!1;mxEvent.addListener(d,"mouseenter",mxUtils.bind(this,function(){"sketch"==Editor.currentTheme&&""!=this.editor.getStatus()&&(this.statusContainer.style.display="inline-flex")}));mxEvent.addListener(d,"mouseleave",mxUtils.bind(this,function(){"sketch"!=Editor.currentTheme||g||(this.statusContainer.style.display="none")}));var n=mxUtils.bind(this,function(){if("sketch"==Editor.currentTheme){var t=
null!=this.statusContainer.firstChild&&"function"===typeof this.statusContainer.firstChild.getAttribute?this.statusContainer.firstChild:null;g=null!=t&&null!=t.getAttribute("class");if(!g&&null!=t){t=t.getAttribute("title");var u=this.getCurrentFile();u=null!=u?u.savingStatusKey:DrawioFile.prototype.savingStatusKey;t==mxResources.get(u)+"..."&&(this.statusContainer.innerHTML='<div><img title="'+mxUtils.htmlEntities(mxResources.get(u))+'..."src="'+Editor.tailSpin+'"></div>',g=!0)}this.statusContainer.style.display=
"none";t=32>=d.clientWidth;d.style.visibility=t&&""==this.editor.getStatus()?"hidden":"";if(t||g)this.statusContainer.style.display="inline-flex",g=!0}else"simple"==Editor.currentTheme?(this.statusContainer.style.display="inline-flex",this.statusContainer.style.display=0==this.statusContainer.clientWidth?"none":"inline-flex"):this.statusContainer.style.display="inline-flex"});this.editor.addListener("statusChanged",n);n()};EditorUi.prototype.switchTheme=function(d){this.isDefaultTheme(d)&&null!=this.formatContainer&&