Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,x,mxResources.get("cancel"),mxResources.get("discardChanges")):x()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var c={};if(null!=this.pages)for(var e=0;e<this.pages.length;e++)this.updatePageRoot(this.pages[e]),this.addBasenamesForCell(this.pages[e].root,c);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),c);e=[];for(var g in c)e.push(g);return e};EditorUi.prototype.addBasenamesForCell=function(c,e){function g(x){if(null!=
x){var B=x.lastIndexOf(".");0<B&&(x=x.substring(B+1,x.length));null==e[x]&&(e[x]=!0)}}var q=this.editor.graph,p=q.getCellStyle(c);g(mxStencilRegistry.getBasenameForStencil(p[mxConstants.STYLE_SHAPE]));q.model.isEdge(c)&&(g(mxMarker.getPackageForType(p[mxConstants.STYLE_STARTARROW])),g(mxMarker.getPackageForType(p[mxConstants.STYLE_ENDARROW])));p=q.model.getChildCount(c);for(var t=0;t<p;t++)this.addBasenamesForCell(q.model.getChildAt(c,t),e)};EditorUi.prototype.setGraphEnabled=function(c){this.diagramContainer.style.visibility=