Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(H=new mxCodec(mxUtils.createXmlDocument()),H=H.encode(new mxGraphModel(v.root)),this.editor.graph.saveViewState(v.viewState,H,null,t),A=A.cloneNode(!1),mxUtils.setTextContent(A,Graph.compressNode(H))));d(A)}return u};EditorUi.prototype.anonymizeString=function(d,g){for(var n=[],t=0;t<d.length;t++){var u=d.charAt(t);0<=EditorUi.ignoredAnonymizedChars.indexOf(u)?n.push(u):isNaN(parseInt(u))?u.toLowerCase()!=u?n.push(String.fromCharCode(65+Math.round(25*Math.random()))):u.toUpperCase()!=u?n.push(String.fromCharCode(97+
Math.round(25*Math.random()))):/\s/.test(u)?n.push(" "):n.push("?"):n.push(g?"0":Math.round(9*Math.random()))}return n.join("")};EditorUi.prototype.anonymizePatch=function(d){if(null!=d[EditorUi.DIFF_INSERT])for(var g=0;g<d[EditorUi.DIFF_INSERT].length;g++)try{var n=mxUtils.parseXml(d[EditorUi.DIFF_INSERT][g].data).documentElement.cloneNode(!1);null!=n.getAttribute("name")&&n.setAttribute("name",this.anonymizeString(n.getAttribute("name")));d[EditorUi.DIFF_INSERT][g].data=mxUtils.getXml(n)}catch(v){d[EditorUi.DIFF_INSERT][g].data=