Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addMenuItems(f,["-","revisionHistory"],u),null!=D&&null!=d.fileNode&&"1"!=urlParams.embedInline&&(E=null!=D.getTitle()?D.getTitle():d.defaultFilename,(D.constructor==DriveFile&&null!=D.sync&&D.sync.isConnected()||!/(\.html)$/i.test(E))&&this.addMenuItems(f,["-","properties"])),this.addMenuItems(f,["-","pageSetup"],u),mxClient.IS_IOS&&navigator.standalone||this.addMenuItems(f,["print"],u),this.addMenuItems(f,["-","close"])})));m.prototype.execute=function(){var f=this.ui.editor.graph;this.customFonts=
this.prevCustomFonts;this.prevCustomFonts=this.ui.menus.customFonts;this.ui.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts));this.extFonts=this.previousExtFonts;for(var u=f.extFonts,D=0;null!=u&&D<u.length;D++){var E=document.getElementById("extFont_"+u[D].name);null!=E&&E.parentNode.removeChild(E)}f.extFonts=[];for(D=0;null!=this.previousExtFonts&&D<this.previousExtFonts.length;D++)this.ui.editor.graph.addExtFont(this.previousExtFonts[D].name,this.previousExtFonts[D].url);
this.previousExtFonts=u};this.put("fontFamily",new Menu(mxUtils.bind(this,function(f,u){for(var D=mxUtils.bind(this,function(R,W,X,Z,Y){var ca=d.editor.graph;Z=this.styleChange(f,Z||R,"1"!=urlParams["ext-fonts"]?[mxConstants.STYLE_FONTFAMILY,"fontSource","FType"]:[mxConstants.STYLE_FONTFAMILY],"1"!=urlParams["ext-fonts"]?[R,null!=W?encodeURIComponent(W):null,null]:[R],null,u,function(){"1"!=urlParams["ext-fonts"]?ca.setFont(R,W):(document.execCommand("fontname",!1,R),ca.addExtFont(R,W));d.fireEvent(new mxEventObject("styleChanged",