Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.style.textAlign="right";g=document.createElement("div");g.className="geToolbarContainer";g.style.cssText="box-shadow:none !important;background-color:transparent;padding:2px;border-style:none !important;bottom:30px;";this.init=function(){function p(G){if(null!=G){var P=G.getAttribute("background");if(null==P||""==P||P==mxConstants.NONE)P=Editor.isDarkMode()?"transparent":"#ffffff";t.style.backgroundColor=P;(new mxCodec(G.ownerDocument)).decode(G,u.getModel());u.maxFitScale=1;u.fit(8);u.center()}return G}