Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.bind(this,function(ca){A=null!=A?A:"pdf"==f?"application/pdf":"image/"+f;if(null!=v)try{this.exportFile(v,G,A,!0,ja,ca)}catch(ia){this.handleError(ia)}else this.spinner.spin(document.body,mxResources.get("saving"))&&fa.send(mxUtils.bind(this,function(){this.spinner.stop();if(200<=fa.getStatus()&&299>=fa.getStatus())try{this.exportFile(fa.getText(),G,A,!0,ja,ca)}catch(ia){this.handleError(ia)}else this.handleError({message:mxResources.get("errorSavingFile")})}),mxUtils.bind(this,function(ia){this.spinner.stop();