Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.filterDrafts=function(b,f,m){function d(){m(u)}var u=[];try{this.getDatabaseItems(mxUtils.bind(this,function(v){EditorUi.debug("App.filterDrafts",[this],"items",v);for(var E=0;E<v.length;E++)try{var F=v[E].key;if(null!=F&&".draft_"==F.substring(0,7)){var L=JSON.parse(v[E].data);null!=L&&"draft"==L.type&&L.aliveCheck!=f&&(null==b&&null==L.fileObject||null!=L.fileObject&&L.fileObject.path==b)&&(L.key=F,u.push(L))}}catch(N){}d()}),d)}catch(v){d()}};