Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f){this.sidebar.sidebarTitles!=d&&(this.sidebar.sidebarTitles=d,this.sidebar.refresh(),Editor.isSettingsEnabled()&&f&&(mxSettings.settings.sidebarTitles=d,mxSettings.save()),this.fireEvent(new mxEventObject("sidebarTitlesChanged")))};EditorUi.prototype.saveScrollState=function(){var d=this.editor.graph.view.translate,f=mxUtils.getOffset(this.diagramContainer),l=this.diagramContainer.scrollLeft-f.x;f=this.diagramContainer.scrollTop-f.y;null!=this.embedViewport&&(Editor.inlineFullscreen?(l-=this.embedViewport.x,
f-=this.embedViewport.y):(l+=this.embedViewport.x,f+=this.embedViewport.y));return{x:l,y:f,tx:d.x,ty:d.y}};EditorUi.prototype.restoreScrollState=function(d){var f=this.editor.graph.view.scale,l=this.editor.graph.view.translate,u=mxUtils.getOffset(this.diagramContainer);this.diagramContainer.scrollLeft=d.x+u.x+(l.x-d.tx)*f;this.diagramContainer.scrollTop=d.y+u.y+(l.y-d.ty)*f};EditorUi.prototype.setInlineFullscreen=function(d){Editor.inlineFullscreen!=d&&(this.diagramContainer.setAttribute("data-scrollState",