Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c,k,l){e={org:e,repo:f,ref:c,name:k.name,path:k.path,sha:k.sha,html_url:k.html_url,download_url:k.download_url};f=k.content;"base64"===k.encoding&&(/\.jpe?g$/i.test(k.name)?f="data:image/jpeg;base64,"+f:/\.gif$/i.test(k.name)?f="data:image/gif;base64,"+f:/\.png$/i.test(k.name)?(k=this.ui.extractGraphModelFromPng(f),f=null!=k&&0<k.length?k:"data:image/png;base64,"+f):f=Base64.decode(f));return l?new GitHubLibrary(this.ui,f,e):new GitHubFile(this.ui,f,e)};GitHubClient.prototype.insertLibrary=function(e,
f,c,k,l){this.insertFile(e,f,c,k,!0,l,!1)};GitHubClient.prototype.insertFile=function(e,f,c,k,l,x,y){l=null!=l?l:!1;x=x.split("/");var E=x[0],D=x[1],z=x[2],M=x.slice(3,x.length).join("/");0<M.length&&(M+="/");M+=e;this.checkExists(E+"/"+D+"/"+z+"/"+M,!0,mxUtils.bind(this,function(I,d){I?l?(y||(f=Base64.encode(f)),this.showCommitDialog(e,!0,mxUtils.bind(this,function(g){this.writeFile(E,D,z,M,g,f,d,mxUtils.bind(this,function(n){try{var t=JSON.parse(n.getText());c(this.createGitHubFile(E,D,z,t.content,