Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.lightboxHost+"/?client=1"+(null!=g?"&page="+g:"")+(u?"&edit=_blank":"")+(v?"&layers=1":"")+"');}}})(this);"),q+="cursor:pointer;"),d&&(d=parseInt(H.getAttribute("width")),u=parseInt(H.getAttribute("height")),H.setAttribute("viewBox","-0.5 -0.5 "+d+" "+u),q+="max-width:100%;max-height:"+u+"px;",H.removeAttribute("height")),""!=q&&H.setAttribute("style",q),this.editor.addFontCss(H),this.editor.graph.mathEnabled&&this.editor.addMathCss(H),A(mxUtils.getXml(H))};EditorUi.prototype.timeSince=function(d){d=
Math.floor((new Date-d)/1E3);var g=Math.floor(d/31536E3);if(1<g)return g+" "+mxResources.get("years");g=Math.floor(d/2592E3);if(1<g)return g+" "+mxResources.get("months");g=Math.floor(d/86400);if(1<g)return g+" "+mxResources.get("days");g=Math.floor(d/3600);if(1<g)return g+" "+mxResources.get("hours");g=Math.floor(d/60);return 1<g?g+" "+mxResources.get("minutes"):1==g?g+" "+mxResources.get("minute"):null};EditorUi.prototype.decodeNodeIntoGraph=function(d,g){if(null!=d){var n=null;if("diagram"==d.nodeName)n=