Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.isDarkMode()?{outBkgClr:Editor.darkColor,cornerClr:Editor.darkColor,strokeClr:"#505759",fontClr:"#BBBBBB",guideClr:"#0088cf"}:{outBkgClr:"#e8e9ed",cornerClr:"#fbfbfb",strokeClr:"#dadce0",fontClr:"#BBBBBB",guideClr:"#0000BB"};M.style[f?"borderRight":"borderBottom"]="0.5px solid "+z.strokeClr;M.style.borderLeft="0.5px solid "+z.strokeClr});this.updateStyle();b.diagramContainer.appendChild(M);mxEvent.disableContextMenu(M);this.editorUiRefresh=b.refresh;b.refresh=function(A){D.editorUiRefresh.apply(b,
arguments);k()};k();var I=document.createElement("canvas");I.width=M.offsetWidth;I.height=M.offsetHeight;M.style.overflow="hidden";I.style.position="relative";M.appendChild(I);var d=I.getContext("2d");this.ui=b;var g=b.editor.graph;this.graph=g;this.container=M;this.canvas=I;var n=function(A,H,L,F,S){A=Math.round(A);H=Math.round(H);L=Math.round(L);F=Math.round(F);d.beginPath();d.moveTo(A+.5,H+.5);d.lineTo(L+.5,F+.5);d.stroke();S&&(f?(d.save(),d.translate(A,H),d.rotate(-Math.PI/2),d.fillText(S,0,0),