Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.isSettingsEnabled=function(){return"undefined"!==typeof window.mxSettings&&(isLocalStorage||mxClient.IS_CHROMEAPP)};Editor.configureFontCss=function(k){if(null!=k){Editor.prototype.fontCss=k;var y=document.getElementsByTagName("script")[0];if(null!=y&&null!=y.parentNode){var G=document.createElement("style");G.setAttribute("type","text/css");G.appendChild(document.createTextNode(k));y.parentNode.insertBefore(G,y);k=k.split("url(");for(G=1;G<k.length;G++){var P=k[G].indexOf(")");P=Editor.trimCssUrl(k[G].substring(0,
P));var Q=document.createElement("link");Q.setAttribute("rel","preload");Q.setAttribute("href",P);Q.setAttribute("as","font");Q.setAttribute("crossorigin","");y.parentNode.insertBefore(Q,y)}}}};Editor.trimCssUrl=function(k){return k.replace(RegExp("^[\\s\"']+","g"),"").replace(RegExp("[\\s\"']+$","g"),"")};Editor.GOOGLE_FONTS="https://fonts.googleapis.com/css?family=";Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(k){k=