Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,A,mxResources.get("cancel"),mxResources.get("discardChanges")):A()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var d={};if(null!=this.pages)for(var g=0;g<this.pages.length;g++)this.updatePageRoot(this.pages[g]),this.addBasenamesForCell(this.pages[g].root,d);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),d);g=[];for(var n in d)g.push(n);return g};EditorUi.prototype.addBasenamesForCell=function(d,g){function n(A){if(null!=
A){var H=A.lastIndexOf(".");0<H&&(A=A.substring(H+1,A.length));null==g[A]&&(g[A]=!0)}}var t=this.editor.graph,u=t.getCellStyle(d);n(mxStencilRegistry.getBasenameForStencil(u[mxConstants.STYLE_SHAPE]));t.model.isEdge(d)&&(n(mxMarker.getPackageForType(u[mxConstants.STYLE_STARTARROW])),n(mxMarker.getPackageForType(u[mxConstants.STYLE_ENDARROW])));u=t.model.getChildCount(d);for(var v=0;v<u;v++)this.addBasenamesForCell(t.model.getChildAt(d,v),g)};EditorUi.prototype.setGraphEnabled=function(d){this.diagramContainer.style.visibility=