Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
else if("svg"==g)c.hideDialog(),c.saveData(e,"svg",mxUtils.getXml(I.getSvg(q,p,t)),"image/svg+xml");else{var A=c.getFileData(!0,null,null,null,null,!0),S=I.getGraphBounds(),l=Math.floor(S.width*p/I.view.scale),n=Math.floor(S.height*p/I.view.scale);if(A.length<=MAX_REQUEST_SIZE&&l*n<MAX_AREA)if(c.hideDialog(),"png"!=g&&"jpg"!=g&&"jpeg"!=g||!c.isExportToCanvas()){var z={globalVars:I.getExportVariables()};B&&(z.grid={size:I.gridSize,steps:I.view.gridSteps,color:I.view.gridColor});c.saveRequest(e,g,function(C,
D){return new mxXmlRequest(EXPORT_URL,"format="+g+"&base64="+(D||"0")+(null!=C?"&filename="+encodeURIComponent(C):"")+"&extras="+encodeURIComponent(JSON.stringify(z))+(0<x?"&dpi="+x:"")+"&bg="+(null!=q?q:"none")+"&w="+l+"&h="+n+"&border="+t+"&xml="+encodeURIComponent(A))})}else"png"==g?c.exportImage(p,null==q||"none"==q,!0,!1,!1,t,!0,!1,null,B,x):c.exportImage(p,!1,!0,!1,!1,t,!0,!1,"jpeg",B);else mxUtils.alert(mxResources.get("drawingTooLarge"))}});EditorUi.prototype.getDiagramTextContent=function(){this.editor.graph.setEnabled(!1);