Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.timeout),H=mxUtils.bind(this,function(){window.clearTimeout(A);v&&t.apply(this,arguments)}),L=mxUtils.bind(this,function(){window.clearTimeout(A);v&&u.apply(this,arguments)});n=n||{};n.callbackId=this.remoteInvokeCallbacks.length;this.remoteInvokeCallbacks.push({callback:H,error:L});d=JSON.stringify({event:"remoteInvoke",funtionName:d,functionArgs:g,msgMarkers:n});null!=this.remoteWin?this.remoteWin.postMessage(d,"*"):this.remoteInvokeQueue.push(d)};EditorUi.prototype.handleRemoteInvoke=function(d,
g){var n=mxUtils.bind(this,function(F,S){var p={event:"remoteInvokeResponse",msgMarkers:d.msgMarkers};null!=S?p.error={errResp:S}:null!=F&&(p.resp=F);this.remoteWin.postMessage(JSON.stringify(p),"*")});try{var t=d.funtionName,u=this.remoteInvokableFns[t];if(null!=u&&"function"===typeof this[t]){if(u.allowedDomains){for(var v=!1,A=0;A<u.allowedDomains.length;A++)if(g=="https://"+u.allowedDomains[A]){v=!0;break}if(!v){n(null,"Invalid Call: "+t+" is not allowed.");return}}var H=d.functionArgs;Array.isArray(H)||
(H=[]);if(u.isAsync)H.push(function(){n(Array.prototype.slice.apply(arguments))}),H.push(function(F){n(null,F||"Unkown Error")}),this[t].apply(this,H);else{var L=this[t].apply(this,H);n([L])}}else n(null,"Invalid Call: "+t+" is not found.")}catch(F){n(null,"Invalid Call: An error occurred, "+F.message)}};EditorUi.prototype.openDatabase=function(d,g){if(null==this.database){var n=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=n)try{var t=n.open("database",2);t.onupgradeneeded=