Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
document.documentMode&&7!=document.documentMode||this.isOfflineApp()||mxClient.IS_IOS};EditorUi.prototype.showTextDialog=function(c,e){c=new TextareaDialog(this,c,e,null,null,mxResources.get("close"));this.showDialog(c.container,620,460,!0,!0,null,null,null,null,!0);c.init();document.execCommand("selectall",!1,null)};EditorUi.prototype.doSaveLocalFile=function(c,e,g,q,p,t){"text/xml"!=g||/(\.drawio)$/i.test(e)||/(\.xml)$/i.test(e)||/(\.svg)$/i.test(e)||/(\.html)$/i.test(e)||(e=e+"."+(null!=t?t:"drawio"));
if(window.Blob&&navigator.msSaveOrOpenBlob)c=q?this.base64ToBlob(c,g):new Blob([c],{type:g}),navigator.msSaveOrOpenBlob(c,e);else if(mxClient.IS_IE)g=window.open("about:blank","_blank"),null==g?mxUtils.popup(c,!0):(g.document.write(c),g.document.close(),g.document.execCommand("SaveAs",!0,e),g.close());else if(mxClient.IS_IOS&&this.isOffline())navigator.standalone||null==g||"image/"!=g.substring(0,6)?this.showTextDialog(e+":",c):this.openInNewWindow(c,g,q);else{var x=document.createElement("a");t=
(null==navigator.userAgent||0>navigator.userAgent.indexOf("PaleMoon/"))&&"undefined"!==typeof x.download;if(mxClient.IS_GC&&null!=navigator.userAgent){var B=navigator.userAgent.match(/Chrom(e|ium)\/([0-9]+)\./);t=65==(B?parseInt(B[2],10):!1)?!1:t}if(t||this.isOffline()){x.href=URL.createObjectURL(q?this.base64ToBlob(c,g):new Blob([c],{type:g}));t?x.download=e:x.setAttribute("target","_blank");document.body.appendChild(x);try{window.setTimeout(function(){URL.revokeObjectURL(x.href)},2E4),x.click(),
x.parentNode.removeChild(x)}catch(I){}}else this.createEchoRequest(c,e,g,q,p).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(c,e,g,q,p,t){c="xml="+encodeURIComponent(c);return new mxXmlRequest(SAVE_URL,c+(null!=g?"&mime="+g:"")+(null!=p?"&format="+p:"")+(null!=t?"&base64="+t:"")+(null!=e?"&filename="+encodeURIComponent(e):"")+(q?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(c,e){e=e||"";c=atob(c);for(var g=c.length,q=Math.ceil(g/1024),p=Array(q),t=0;t<q;++t){for(var x=