Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(H||M==mxConstants.NONE)M=null;var ba=this.editor.graph.getSvg(M,null,null,null,null,v);k&&this.editor.graph.addSvgShadow(ba);this.editor.convertImages(ba,mxUtils.bind(this,mxUtils.bind(this,function(V){this.spinner.stop();C(Graph.xmlDeclaration+"\n"+Graph.svgDoctype+"\n"+mxUtils.getXml(V))})))}else ia=ca+".svg",m=this.getFileData(!1,!0,null,mxUtils.bind(this,function(V){this.spinner.stop();C(V)}),v)}}catch(V){this.handleError(V)}};EditorUi.prototype.createDownloadRequest=function(d,f,k,v,z,A,H,
J,O,G,ja,fa,ca){d=this.downloadRequestBuilder(d,f,k,v,z,A,H,J,O,G,ja,fa,ca);f="";for(var ia in d)k=d[ia],null!=k&&(f+=ia+"="+encodeURIComponent(k)+"&");return new mxXmlRequest(EXPORT_URL,f)};EditorUi.prototype.downloadRequestBuilder=function(d,f,k,v,z,A,H,J,O,G,ja,fa,ca){var ia=this.editor.graph,ma=ia.getGraphBounds();k=this.getFileData(!0,null,null,null,k,0==A?!1:"xmlpng"!=f,null,null,null,!Editor.defaultCompressed,"pdf"==f);var da=null,S=null,U=null;if(ma.width*ma.height>MAX_AREA||k.length>MAX_REQUEST_SIZE)throw{message:mxResources.get("drawingTooLarge")};