Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c?c:"",extras:JSON.stringify(p),scale:x,border:B,w:l&&isFinite(l)?l:null,h:n&&isFinite(n)?n:null}};EditorUi.prototype.setMode=function(c,e){this.mode=c};EditorUi.prototype.getDiagramId=function(){var c=window.location.hash;null!=c&&0<c.length&&(c=c.substring(1));if(null!=c&&1<c.length){var e=c.indexOf("#");0<=e&&(c=c.substring(0,e))}return c};EditorUi.prototype.getHashObject=function(){var c=window.location.hash,e={};if(null!=c&&0<c.length){var g=c.lastIndexOf("#");if(0<g){c=decodeURIComponent(c.substring(g+
1));try{e=JSON.parse(c)}catch(q){}}}return e};EditorUi.prototype.updateHashObject=function(){if(null!=this.currentFile&&""!=this.currentFile.getHash()&&null!=this.currentPage&&0<this.getSelectedPageIndex()){var c=this.getHashObject();c.pageId=this.currentPage.getId();this.setHashObject(c)}else this.setHashObject(null)};EditorUi.prototype.setHashObject=function(c){if(Editor.enableHashObjects){var e=window.location.hash;if(null==e||""==e)e="#";var g=e.lastIndexOf("#");0<g&&(e=e.substring(0,g));try{null==