Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null==l||l.constructor==EmbedFile||l.constructor==LocalFile&&null==l.mode||c.saveFile()},c.actions.addAction("saveAndExit",function(){"1"==urlParams.toSvg?c.sendEmbeddedSvgExport():c.actions.get("save").funct(!0)}).label="1"==urlParams.publishClose?mxResources.get("publish"):mxResources.get("saveAndExit"),c.actions.addAction("exit",function(){if("1"==urlParams.embedInline)c.sendEmbeddedSvgExport();else{var l=function(){c.editor.modified=!1;var y="json"==urlParams.proto?JSON.stringify({event:"exit",
modified:c.editor.modified}):"";(window.opener||window.parent).postMessage(y,"*")};c.editor.modified?c.confirm(mxResources.get("allChangesLost"),null,l,mxResources.get("cancel"),mxResources.get("discardChanges")):l()}},null,null,"1"==urlParams.embedInline?"Escape":null));this.put("exportAs",new Menu(mxUtils.bind(this,function(l,y){c.isExportToCanvas()?(this.addMenuItems(l,["exportPng"],y),c.jpgSupported&&this.addMenuItems(l,["exportJpg"],y)):c.isOffline()||mxClient.IS_IOS&&navigator.standalone||this.addMenuItems(l,