Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
P.length&&(Q=P[Math.max(0,Math.min(P.length-1,urlParams.page||0))])),null!=Q&&(k=Editor.parseDiagramNode(Q,G)));null==k||"mxGraphModel"==k.nodeName||y&&"mxfile"==k.nodeName||(k=null);return k};Editor.parseDiagramNode=function(k,y){var G=mxUtils.trim(mxUtils.getTextContent(k)),P=null;0<G.length?(k=Graph.decompress(G,null,y),null!=k&&0<k.length&&(P=mxUtils.parseXml(k).documentElement)):(k=mxUtils.getChildNodes(k),0<k.length&&(P=mxUtils.createXmlDocument(),P.appendChild(P.importNode(k[0],!0)),P=P.documentElement));
return P};Editor.getDiagramNodeXml=function(k){var y=mxUtils.getTextContent(k),G=null;0<y.length?G=Graph.decompress(y):null!=k.firstChild&&(G=mxUtils.getXml(k.firstChild));return G};Editor.extractGraphModelFromPdf=function(k){k=k.substring(k.indexOf(",")+1);k=window.atob&&!mxClient.IS_SF?atob(k):Base64.decode(k,!0);if("%PDF-1.7"==k.substring(0,8)){var y=k.indexOf("EmbeddedFile");if(-1<y){var G=k.indexOf("stream",y)+9;if(0<k.substring(y,G).indexOf("application#2Fvnd.jgraph.mxfile"))return y=k.indexOf("endstream",