Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.fileSaved=function(b,e,g,n,y,q,E){this.lastSaved=new Date;this.ageStart=null;this.stats.saved++;try{this.invalidChecksum=this.inConflictState=!1;q=null!=q?q:this.ui.getPagesForXml(b);try{null==this.sync||this.isOptimisticSync()?(this.setShadowPages(q),null!=this.sync&&(this.sync.lastModified=this.getLastModifiedDate(),this.sync.resetUpdateStatusThread(),this.isRealtime()&&this.sync.scheduleCleanup()),null!=g&&g()):this.sync.fileSaved(q,e,g,n,y,E)}catch(G){this.invalidChecksum=
this.inConflictState=!0;this.descriptorChanged();null!=n&&n(G);try{if(this.errorReportsEnabled)this.sendErrorReport("Error in fileSaved",null,G);else{var K=this.getCurrentUser(),S=null!=K?K.id:"unknown";EditorUi.logError("Error in fileSaved",null,this.getMode()+"."+this.getId(),S,G)}}catch(L){}}EditorUi.debug("DrawioFile.fileSaved",[this],"savedData",[b],"desc",[e],"inConflictState",this.inConflictState,"invalidChecksum",this.invalidChecksum)}catch(G){this.descriptorChanged(),null!=n&&n(G)}};