Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.isSelectionEmpty()||null==d.addSelectionToScratchpad||this.addMenuItems(U,["-","addToScratchpad"],null,Y);f.isSelectionEmpty()&&"simple"==Editor.currentTheme&&this.addMenuItems(U,["-","exitGroup","home"],null,Y)};var G=Menus.prototype.addPopupMenuEditItems;this.menus.addPopupMenuEditItems=function(U,Q,Y){if(d.editor.graph.isSelectionEmpty())G.apply(this,arguments),d.menus.addMenuItems(U,["copyAsImage"],null,Y);else if(this.isShowCellEditItems()?this.addPopupDeleteItem(U,Q,Y):this.addPopupMenuArrangeItems(U,
Q,Y),this.addMenuItems(U,"- cut copy copyAsImage duplicate -".split(" "),null,Y),this.isShowCellEditItems()||this.addPopupDeleteItem(U,Q,Y),this.addMenuItems(U,["lockUnlock","-"],null,Y),!this.isShowStyleItems()){if(1==f.getSelectionCount()&&!f.isCellLocked(Q)&&f.isCellEditable(Q)&&(this.addSubmenu("editCell",U,null,mxResources.get("edit")),U.addSeparator(),f.getModel().isEdge(Q))){this.addSubmenu("line",U);var m=f.getModel().getGeometry(Q);null!=m&&null!=m.points&&0<m.points.length&&this.addMenuItems(U,
["clearWaypoints"],null,Y)}1==f.getSelectionCount()&&this.addMenuItems(U,["enterGroup"],null,Y);m=d.getSelectionState();null!=m.mergeCell?this.addMenuItem(U,"mergeCells"):(1<m.style.colspan||1<m.style.rowspan)&&this.addMenuItem(U,"unmergeCells")}};this.menus.isShowStyleItems=function(){return"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme};this.menus.isShowHistoryItems=function(){return"simple"!=Editor.currentTheme};this.menus.isShowArrangeItems=this.menus.isShowStyleItems;