Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
StorageFile.listFiles=function(b,f,m,d){b.getDatabaseItems(function(u){var v=[];if(null!=u)for(var E=0;E<u.length;E++)"."==u[E].title.charAt(0)||null!=f&&u[E].type!=f||v.push(u[E]);m(v)},function(){null==b.database?m(StorageFile.listLocalStorageFiles(f)):null!=d&&d()},"filesInfo")};StorageFile.deleteFile=function(b,f,m,d){b.removeDatabaseItem([f,f],m,function(){null==b.database?(localStorage.removeItem(f),m()):null!=d&&d()},["files","filesInfo"])};StorageLibrary=function(b,f,m){StorageFile.call(this,b,f,m)};mxUtils.extend(StorageLibrary,StorageFile);StorageLibrary.prototype.type="L";StorageLibrary.prototype.isAutosave=function(){return!0};StorageLibrary.prototype.saveAs=function(b,f,m){this.saveFile(b,!1,f,m)};StorageLibrary.prototype.getHash=function(){return"L"+encodeURIComponent(this.title)};StorageLibrary.prototype.getTitle=function(){return".scratchpad"==this.title?mxResources.get("scratchpad"):this.title};