Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(){g(Error(mxResources.get("timeout")+" "+p.getAttribute("href")))}))}};EditorUi.prototype.setPagesVisible=function(c){Editor.pagesVisible!=c&&(Editor.pagesVisible=c,mxSettings.settings.pagesVisible=c,mxSettings.save(),this.fireEvent(new mxEventObject("pagesVisibleChanged")))};EditorUi.prototype.setSidebarTitles=function(c,e){this.sidebar.sidebarTitles!=c&&(this.sidebar.sidebarTitles=c,this.sidebar.refresh(),Editor.isSettingsEnabled()&&e&&(mxSettings.settings.sidebarTitles=
c,mxSettings.save()),this.fireEvent(new mxEventObject("sidebarTitlesChanged")))};EditorUi.prototype.saveScrollState=function(){var c=this.editor.graph.view.translate,e=mxUtils.getOffset(this.diagramContainer),g=this.diagramContainer.scrollLeft-e.x;e=this.diagramContainer.scrollTop-e.y;null!=this.embedViewport&&(Editor.inlineFullscreen?(g-=this.embedViewport.x,e-=this.embedViewport.y):(g+=this.embedViewport.x,e+=this.embedViewport.y));return{x:g,y:e,tx:c.x,ty:c.y}};EditorUi.prototype.restoreScrollState=