Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
new Uint8Array(O)}return new Blob(A,{type:f})};EditorUi.prototype.saveLocalFile=function(d,f,l,u,A,B,F,M){B=null!=B?B:!1;F=null!=F?F:"vsdx"!=A&&(!mxClient.IS_IOS||!navigator.standalone);var O=mxUtils.bind(this,function(ja,da,ca,ia){try{if("_blank"==da)if(null!=l&&"image/"==l.substring(0,6))this.openInNewWindow(d,l,u);else if(null!=l&&"text/html"==l.substring(0,9)){var ma=new EmbedDialog(this,d);this.showDialog(ma.container,450,240,!0,!0);ma.init()}else{var aa=window.open("about:blank");null==aa?mxUtils.popup(d,
!0):(aa.document.write("<pre>"+mxUtils.htmlEntities(d,!1)+"</pre>"),aa.document.close())}else if(da==App.MODE_DEVICE||"download"==da)this.doSaveLocalFile(d,ja,l,u,null,M);else if(null!=ja&&0<ja.length){var la=mxUtils.bind(this,function(X){try{this.exportFile(d,ja,l,u,da,X)}catch(P){this.handleError(P)}});null!=ia?la(ia):this.pickFolder(da,la)}}catch(X){this.handleError(X)}});if("1"==urlParams["save-dialog"])A=[],B||A.push(App.MODE_BROWSER),F||A.push("_blank"),f=new SaveDialog(this,f,mxUtils.bind(this,
function(ja,da,ca){O(ja.value,da,ja,ca);this.hideDialog()}),A,d,l,u),this.showDialog(f.container,420,100,!0,!1,mxUtils.bind(this,function(){this.hideDialog()}));else{A=this.getServiceCount(B);isLocalStorage&&A++;var H=4>=A?2:6<A?4:3;f=new CreateDialog(this,f,O,mxUtils.bind(this,function(){this.hideDialog()}),mxResources.get("saveAs"),mxResources.get("download"),!1,B,F,null,1<A,H,d,l,u);B=this.isServices(A)?A>H?390:280:160;this.showDialog(f.container,420,B,!0,!0)}f.init()};EditorUi.prototype.openInNewWindow=