Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.fileCreated=function(b,e,f,c,k,l){var x=window.location.pathname;null!=e&&0<e.length&&(x+="?libs="+e);null!=k&&0<k.length&&(x+="?clibs="+k);x=this.getUrl(x);b.getMode()!=App.MODE_DEVICE&&(x+="#"+b.getHash());if(this.spinner.spin(document.body,mxResources.get("inserting"))){var y=b.getData();y=0<y.length?this.editor.extractGraphModel(mxUtils.parseXml(y).documentElement,!0):null;var E=window.location.protocol+"//"+window.location.hostname+x,D=y,z=null;null!=y&&/\.svg$/i.test(b.getTitle())&&
(z=this.createTemporaryGraph(this.editor.graph.getStylesheet()),document.body.appendChild(z.container),D=this.decodeNodeIntoGraph(D,z));b.setData(this.createFileData(y,z,b,E));null!=z&&z.container.parentNode.removeChild(z.container);var M=mxUtils.bind(this,function(){this.spinner.stop()}),I=mxUtils.bind(this,function(){M();var d=this.getCurrentFile();null==f&&null!=d&&(f=!d.isModified()&&null==d.getMode());var g=mxUtils.bind(this,function(){window.openFile=null;this.fileLoaded(b,null,l);f&&b.addAllSavedStatus();
null!=e&&this.sidebar.showEntries(e);if(null!=k){for(var t=[],u=k.split(";"),v=0;v<u.length;v++)t.push(decodeURIComponent(u[v]));this.loadLibraries(t)}}),n=mxUtils.bind(this,function(){f||null==d||!d.isModified()?g():this.confirm(mxResources.get("allChangesLost"),null,g,mxResources.get("cancel"),mxResources.get("discardChanges"))});null!=c&&c();null==f||f?n():(b.constructor==LocalFile&&(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(b.getData(),b.getTitle(),
null==b.getMode())),null!=c&&c(),window.openWindow(x,null,n))});b.constructor==LocalFile?I():b.saveFile(b.getTitle(),!1,mxUtils.bind(this,function(){I()}),mxUtils.bind(this,function(d){M();null!=d&&"AbortError"==d.name||this.handleError(d)}))}};