Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(l){return K.getImageUrl(l)};mxClient.IS_SVG&&this.graph.addSvgShadow(this.graph.view.canvas.ownerSVGElement,null,!0);if("mxfile"==this.xmlNode.nodeName){var S=this.xmlNode.getElementsByTagName("diagram");if(0<S.length){if(null!=this.pageId)for(var G=0;G<S.length;G++)if(this.pageId==S[G].getAttribute("id")){this.currentPage=G;break}var L=this.graph.getGlobalVariable;K=this;this.graph.getGlobalVariable=function(l){var u=S[K.currentPage];return"page"==l?u.getAttribute("name")||"Page-"+(K.currentPage+
1):"pagenumber"==l?K.currentPage+1:"pagecount"==l?S.length:L.apply(this,arguments)}}}this.diagrams=[];var R=null;this.selectPage=function(l){this.handlingResize||(this.currentPage=mxUtils.mod(l,this.diagrams.length),this.updateGraphXml(Editor.parseDiagramNode(this.diagrams[this.currentPage])))};this.selectPageById=function(l){l=this.getIndexById(l);var u=0<=l;u&&this.selectPage(l);return u};G=mxUtils.bind(this,function(){if(null==this.xmlNode||"mxfile"!=this.xmlNode.nodeName)this.diagrams=[];this.xmlNode!=