Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.updateFile=function(b,e,g,n){null!=g&&g()||(EditorUi.debug("DrawioFile.updateFile",[this],"invalidChecksum",this.invalidChecksum),this.ui.getCurrentFile()!=this||this.invalidChecksum?null!=e&&e():this.getLatestVersion(mxUtils.bind(this,function(y){try{null!=g&&g()||(EditorUi.debug("DrawioFile.updateFile",[this],"invalidChecksum",this.invalidChecksum,"latestFile",[y]),this.ui.getCurrentFile()!=this||this.invalidChecksum?null!=e&&e():null!=y?this.mergeFile(y,b,e,n):this.reloadFile(b,e))}catch(q){null!=
e&&e(q)}}),e))};