Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.getEmbeddedSvg(this.getFileData(!0,null,null,null,null,null,null,null,null,!1),e,null,!0,mxUtils.bind(this,function(p){g.postMessage(JSON.stringify({event:"export",point:this.embedExitPoint,exit:null!=c?!c:!0,data:Editor.createSvgDataUri(p)}),"*")}),null,null,!0,q,1,this.embedExportBorder)}else c||g.postMessage(JSON.stringify({event:"exit",point:this.embedExitPoint}),"*");c||(this.diagramContainer.removeAttribute("data-bounds"),Editor.inlineFullscreen=!1,e.model.clear(),this.editor.undoManager.clear(),