Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(B){try{A=A||"objects";Array.isArray(A)||(A=[A],d=[d],f=[f]);var F=B.transaction(A,"readwrite");F.oncomplete=l;F.onerror=u;for(B=0;B<A.length;B++)F.objectStore(A[B]).put(null!=d&&null!=d[B]?{key:d[B],data:f[B]}:f[B])}catch(M){null!=u&&u(M)}}),u)};EditorUi.prototype.removeDatabaseItem=function(d,f,l,u){this.openDatabase(mxUtils.bind(this,function(A){u=u||"objects";Array.isArray(u)||(u=[u],d=[d]);A=A.transaction(u,"readwrite");A.oncomplete=f;A.onerror=l;for(var B=0;B<u.length;B++)A.objectStore(u[B]).delete(d[B])}),
l)};EditorUi.prototype.getDatabaseItem=function(d,f,l,u){this.openDatabase(mxUtils.bind(this,function(A){try{u=u||"objects";var B=A.transaction([u],"readonly").objectStore(u).get(d);B.onsuccess=function(){f(B.result)};B.onerror=l}catch(F){null!=l&&l(F)}}),l)};EditorUi.prototype.getDatabaseItems=function(d,f,l){this.openDatabase(mxUtils.bind(this,function(u){try{l=l||"objects";var A=u.transaction([l],"readonly").objectStore(l).openCursor(IDBKeyRange.lowerBound(0)),B=[];A.onsuccess=function(F){null==