Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(0<M.length&&(M+="\n"),M+=F);F=new LocalFile(this,"csv"!=d.format&&0<M.length?M:this.emptyDiagramXml,null!=urlParams.title?decodeURIComponent(urlParams.title):this.defaultFilename,!0);F.getHash=function(){return u};this.fileLoaded(F);"csv"==d.format&&this.importCsv(M,mxUtils.bind(this,function(ca){this.editor.undoManager.clear();this.editor.setModified(!1);this.editor.setStatus("")}));if(null!=d.update){var O=null!=d.interval?parseInt(d.interval):6E4,H=null,ja=mxUtils.bind(this,function(){var ca=