Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.diagramContainer.scrollLeft+=c.x-e.x;this.diagramContainer.scrollTop+=c.x-e.x};EditorUi.prototype.setDarkMode=function(c){this.doSetDarkMode(c,mxUtils.bind(this,function(){this.fireEvent(new mxEventObject("darkModeChanged"))}),mxUtils.bind(this,function(e){null!=window.console&&console.error(e);this.editor.setStatus(e.message)}))};EditorUi.prototype.createDarkStyle=function(){var c=document.createElement("link");c.setAttribute("rel","stylesheet");c.setAttribute("href",STYLE_PATH+"/dark.css");
c.setAttribute("charset","UTF-8");c.setAttribute("type","text/css");return c};EditorUi.prototype.doSetDarkMode=function(c,e,g){var q=mxUtils.bind(this,function(){if(Editor.darkMode!=c){var t=this.editor.graph;Editor.darkMode=c;this.spinner.opts.color=Editor.isDarkMode()?"#c0c0c0":"#000";t.view.defaultGridColor=Editor.isDarkMode()?mxGraphView.prototype.defaultDarkGridColor:mxGraphView.prototype.defaultGridColor;t.view.gridColor=t.view.defaultGridColor;t.defaultPageBackgroundColor="1"==urlParams.embedInline?