Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null!=B.viewState.backgroundImage.originalSrc&&(M=new mxCodec(mxUtils.createXmlDocument()),M=M.encode(new mxGraphModel(B.root)),this.editor.graph.saveViewState(B.viewState,M,null,u),F=F.cloneNode(!1),mxUtils.setTextContent(F,Graph.compressNode(M))));d(F)}return A};EditorUi.prototype.anonymizeString=function(d,f){for(var l=[],u=0;u<d.length;u++){var A=d.charAt(u);0<=EditorUi.ignoredAnonymizedChars.indexOf(A)?l.push(A):isNaN(parseInt(A))?A.toLowerCase()!=A?l.push(String.fromCharCode(65+Math.round(25*
Math.random()))):A.toUpperCase()!=A?l.push(String.fromCharCode(97+Math.round(25*Math.random()))):/\s/.test(A)?l.push(" "):l.push("?"):l.push(f?"0":Math.round(9*Math.random()))}return l.join("")};EditorUi.prototype.anonymizePatch=function(d){if(null!=d[EditorUi.DIFF_INSERT])for(var f=0;f<d[EditorUi.DIFF_INSERT].length;f++)try{var l=mxUtils.parseXml(d[EditorUi.DIFF_INSERT][f].data).documentElement.cloneNode(!1);null!=l.getAttribute("name")&&l.setAttribute("name",this.anonymizeString(l.getAttribute("name")));