Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,K),0<R.length&&(m=mxUtils.parseXml(R),m=m.documentElement))))}if(null!=m&&"svg"==m.nodeName)if(R=m.getAttribute("content"),null!=R&&"<"!=R.charAt(0)&&"%"!=R.charAt(0)&&(R=unescape(window.atob?atob(R):Base64.decode(cont,R))),null!=R&&"%"==R.charAt(0)&&(R=decodeURIComponent(R)),null!=R&&0<R.length)m=mxUtils.parseXml(R).documentElement;else throw{message:mxResources.get("notADiagramFile")};null==m||B||(U=null,"diagram"==m.nodeName?U=m:"mxfile"==m.nodeName&&(R=m.getElementsByTagName("diagram"),0<
R.length&&(U=R[Math.max(0,Math.min(R.length-1,urlParams.page||0))])),null!=U&&(m=Editor.parseDiagramNode(U,K)));null==m||"mxGraphModel"==m.nodeName||B&&"mxfile"==m.nodeName||(m=null);return m};Editor.parseDiagramNode=function(m,B){var K=mxUtils.trim(mxUtils.getTextContent(m)),R=null;0<K.length?(m=Graph.decompress(K,null,B),null!=m&&0<m.length&&(R=mxUtils.parseXml(m).documentElement)):(m=mxUtils.getChildNodes(m),0<m.length&&(R=mxUtils.createXmlDocument(),R.appendChild(R.importNode(m[0],!0)),R=R.documentElement));