Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.createFile=function(b,e,f,c,k,l,x,y,E,D){c=y?null:null!=c?c:this.mode;if(null!=b&&this.spinner.spin(document.body,mxResources.get("inserting"))){e=null!=e?e:this.emptyDiagramXml;null==e||Editor.defaultCompressed||(e=this.uncompressPages(e));var z=mxUtils.bind(this,function(){this.spinner.stop()}),M=mxUtils.bind(this,function(I){z();null==I&&null==this.getCurrentFile()&&null==this.dialog?this.showSplash():null!=I&&this.handleError(I)});try{c==App.MODE_GOOGLE&&null!=this.drive?(null==
x&&null!=this.stateArg&&null!=this.stateArg.folderId&&(x=this.stateArg.folderId),this.drive.insertFile(b,e,x,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M)):c==App.MODE_GITHUB&&null!=this.gitHub?this.gitHub.insertFile(b,e,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M,!1,x):c==App.MODE_GITLAB&&null!=this.gitLab?this.gitLab.insertFile(b,e,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M,!1,x):c==App.MODE_TRELLO&&null!=this.trello?this.trello.insertFile(b,
e,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M,!1,x):c==App.MODE_DROPBOX&&null!=this.dropbox?this.dropbox.insertFile(b,e,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M):c==App.MODE_ONEDRIVE&&null!=this.oneDrive?this.oneDrive.insertFile(b,e,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M,!1,x):c==App.MODE_BROWSER?StorageFile.insertFile(this,b,e,mxUtils.bind(this,function(I){z();this.fileCreated(I,f,l,k,E,D)}),M):!y&&c==App.MODE_DEVICE&&
EditorUi.nativeFileSupport?(z(),this.showSaveFilePicker(mxUtils.bind(this,function(I,d){var g=new LocalFile(this,e,d.name,null,I,d);g.saveFile(d.name,!1,mxUtils.bind(this,function(){this.fileCreated(g,f,l,k,E,D)}),M,!0)}),mxUtils.bind(this,function(I){"AbortError"!=I.name&&M(I)}),this.createFileSystemOptions(b))):(z(),this.fileCreated(new LocalFile(this,e,b,null==c),f,l,k,E,D))}catch(I){z(),this.handleError(I)}}};