Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.showPageLinkDialog=function(b){var f=this.editor.graph;this.showPublishLinkDialog(mxResources.get("url"),!0,null,null,mxUtils.bind(this,function(m,d,u,v,E,F){m=this.createUrlParameters(m,d,u,v,E,F);u||m.push("hide-pages=1");f.isSelectionEmpty()||(u=f.getBoundingBox(f.getSelectionCells()),d=f.view.translate,E=f.view.scale,u.width/=E,u.height/=E,u.x=u.x/E-d.x,u.y=u.y/E-d.y,m.push("viewbox="+encodeURIComponent(JSON.stringify({x:Math.round(u.x),y:Math.round(u.y),width:Math.round(u.width),
height:Math.round(u.height),border:100}))));v=new EmbedDialog(this,this.getLinkForPage(b,m,v));this.showDialog(v.container,450,240,!0,!0);v.init()}))};(function(){mxCodecRegistry.getCodec(ChangePageSetup).exclude.push("page")})();(function(){var b=new mxObjectCodec(new MovePage,["ui"]);b.beforeDecode=function(f,m,d){d.ui=f.ui;return m};b.afterDecode=function(f,m,d){f=d.oldIndex;d.oldIndex=d.newIndex;d.newIndex=f;return d};mxCodecRegistry.register(b)})();