Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
else throw Error(mxResources.get("readOnly"));}catch(E){if(null!=m)m(E);else throw E;}};DrawioFile.prototype.createData=function(){var b=this.ui.pages;if(this.isRealtime()&&(this.ui.pages=this.ownPages,null!=this.ui.currentPage)){var f=this.ui.getPageById(this.ui.currentPage.getId(),this.ownPages);null!=f&&(f.viewState=this.ui.editor.graph.getViewState(),f.needsUpdate=!0)}f=this.ui.getFileData(null,null,null,null,null,null,null,null,this,!this.isCompressed());this.ui.pages=b;return f};