Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F.freehand){var ma=F.freehand.createStyle;F.freehand.createStyle=function(ha){return ma.apply(this,arguments)+"sketch=0;"}}B.editor.addListener("statusChanged",mxUtils.bind(this,function(){B.setStatusText(B.editor.getStatus())}));B.setStatusText(B.editor.getStatus());var aa=B.menus.get("viewZoom");if(null!=aa){var la=function(ha){if(mxEvent.isAltDown(ha))B.hideCurrentMenu(),B.actions.get("customZoom").funct(),mxEvent.consume(ha);else if("geMenuItem"==mxEvent.getSource(ha).className||mxEvent.isShiftDown(ha))B.hideCurrentMenu(),
B.actions.get("smartFit").funct(),mxEvent.consume(ha)},X=B.actions.get("zoomIn"),P=B.actions.get("zoomOut"),U=B.actions.get("resetView"),k=B.actions.get("undo"),z=B.actions.get("redo"),J=d("",k.funct,null,mxResources.get("undo")+" ("+k.shortcut+")",k,Editor.undoImage),W=d("",z.funct,null,mxResources.get("redo")+" ("+z.shortcut+")",z,Editor.redoImage),T=d("",la,!0,mxResources.get("fit")+" ("+Editor.ctrlKey+"+H)",U,Editor.zoomFitImage);M.style.cssText="position:absolute;left:0px;right:0px;top:0px;height:30px;padding:8px;text-align:left;white-space:nowrap;";