Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M.push(function(H){l(null,H||"Unkown Error")}),this[u].apply(this,M);else{var O=this[u].apply(this,M);l([O])}}else l(null,"Invalid Call: "+u+" is not found.")}catch(H){l(null,"Invalid Call: An error occurred, "+H.message)}};EditorUi.prototype.openDatabase=function(d,f){if(null==this.database){var l=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=l)try{var u=l.open("database",2);u.onupgradeneeded=function(A){try{var B=u.result;1>A.oldVersion&&B.createObjectStore("objects",{keyPath:"key"});
2>A.oldVersion&&(B.createObjectStore("files",{keyPath:"title"}),B.createObjectStore("filesInfo",{keyPath:"title"}),EditorUi.migrateStorageFiles=isLocalStorage)}catch(F){null!=f&&f(F)}};u.onsuccess=mxUtils.bind(this,function(A){try{var B=u.result;this.database=B;EditorUi.migrateStorageFiles&&(StorageFile.migrate(B),EditorUi.migrateStorageFiles=!1);"app.diagrams.net"!=location.host||this.drawioMigrationStarted||(this.drawioMigrationStarted=!0,this.getDatabaseItem(".drawioMigrated3",mxUtils.bind(this,