Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ma,"png");O(ia)}),null,null,null,mxUtils.bind(this,function(ia){M({message:mxResources.get("unknownError")})}),null,!0,l?2:1,null,f,null,null,Editor.defaultBorder);else if(f=this.getFileData(!0),H.width*H.height<=MAX_AREA&&f.length<=MAX_REQUEST_SIZE){var da="";l&&(da="&w="+Math.round(2*H.width)+"&h="+Math.round(2*H.height));var ca=new mxXmlRequest(EXPORT_URL,"format=png&base64=1&embedXml="+(u?"1":"0")+da+"&xml="+encodeURIComponent(f));ca.send(mxUtils.bind(this,function(){200<=ca.getStatus()&&299>=