Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"#ffffff";u.panningHandler.ignoreCell=!0;u.panningHandler.useLeftButtonForPanning=!0;u.minFitScale=null;u.maxFitScale=null;u.centerZoom=!0;var v=mxUtils.parseXml(f),A=b.editor.extractGraphModel(v.documentElement,!0),H=0,L=null,F=u.getGlobalVariable;u.getGlobalVariable=function(p){return"page"==p&&null!=L&&null!=L[H]?L[H].getAttribute("name"):"pagenumber"==p?H+1:"pagecount"==p?null!=L?L.length:1:F.apply(this,arguments)};u.getLinkForCell=function(){return null};f=b.createToolbarButton(Editor.zoomInImage,