Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
n.style.left="50%"}d.appendChild(this.sidebarContainer);d.style.overflow="hidden"};EditorUi.prototype.createShapesWindow=function(){if(null==this.sidebarWindow){var d=Math.min(this.diagramContainer.parentNode.clientWidth-10,218),g="1"==urlParams.embedInline?650:Math.min(this.diagramContainer.parentNode.clientHeight,650),n="simple"==Editor.currentTheme||"sketch"==Editor.currentTheme;this.sidebarWindow=new WrapperWindow(this,mxResources.get("shapes"),n&&"1"!=urlParams.embedInline?66:10,n&&"1"!=urlParams.embedInline?
Math.max(30,(this.diagramContainer.parentNode.clientHeight-g)/2):56,d-6,g-6,mxUtils.bind(this,function(t){this.createShapesPanel(t)}));this.sidebarWindow.window.addListener(mxEvent.SHOW,mxUtils.bind(this,function(){this.sidebarWindow.window.fit()}));this.sidebarWindow.window.minimumSize=new mxRectangle(0,0,90,90);this.sidebarWindow.window.setVisible(!1)}};EditorUi.prototype.setSketchMode=function(d){this.spinner.spin(document.body,mxResources.get("working")+"...")&&window.setTimeout(mxUtils.bind(this,