Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.handleConflictError=function(b,e){var g=mxUtils.bind(this,function(){this.handleFileSuccess(!0)}),n=mxUtils.bind(this,function(E){this.handleFileError(E,!0)}),y=mxUtils.bind(this,function(){this.ui.spinner.spin(document.body,mxResources.get(this.savingSpinnerKey))&&(this.ui.editor.setStatus(""),this.save(!0,g,n,null,!0,this.constructor!=GitHubFile&&this.constructor!=GitLabFile||null==b?null:b.commitMessage))}),q=mxUtils.bind(this,function(){this.ui.spinner.spin(document.body,mxResources.get("updatingDocument"))&&
this.synchronizeFile(mxUtils.bind(this,function(){this.ui.spinner.stop();this.ui.spinner.spin(document.body,mxResources.get(this.savingSpinnerKey))&&this.save(!0,g,n,null,null,this.constructor!=GitHubFile&&this.constructor!=GitLabFile||null==b?null:b.commitMessage)}),n)});"none"==DrawioFile.SYNC?this.showCopyDialog(g,n,y):this.invalidChecksum?this.showRefreshDialog(g,n,this.getErrorMessage(b)):e?this.showConflictDialog(y,q):this.addConflictStatus(this.getErrorMessage(b),mxUtils.bind(this,function(){this.ui.editor.setStatus(mxUtils.htmlEntities(mxResources.get("updatingDocument")));
this.synchronizeFile(g,n)}))};DrawioFile.prototype.getErrorMessage=function(b){var e=null!=b?null!=b.error?b.error.message:b.message:null;null==e&&null!=b&&b.code==App.ERROR_TIMEOUT?e=mxResources.get("timeout"):"0"==e&&(e=mxResources.get("noResponse"));return e};DrawioFile.prototype.isOverdue=function(){return null!=this.ageStart&&Date.now()-this.ageStart.getTime()>=this.ui.warnInterval};