Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.editor.setStatus(""),d?g.reloadFile(mxUtils.bind(this,function(){g.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(n){g.handleFileError(n,!0)})):g.synchronizeFile(mxUtils.bind(this,function(){g.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(n){g.handleFileError(n,!0)}))))};EditorUi.prototype.getFileData=function(d,g,n,t,u,v,A,H,L,F,S){u=null!=u?u:!0;v=null!=v?v:!1;F=null!=F?F:!Editor.defaultCompressed;var p=this.editor.graph;if(g||!d&&null!=
L&&/(\.svg)$/i.test(L.getTitle())){var q=null!=p.themes&&"darkTheme"==p.defaultThemeName;if(q||null!=this.pages&&this.currentPage!=this.pages[0]){var C=p.getGlobalVariable;p=this.createTemporaryGraph(q?p.getDefaultStylesheet():p.getStylesheet());p.setBackgroundImage=this.editor.graph.setBackgroundImage;p.background=this.editor.graph.background;var J=null!=this.pages?this.pages[0]:null;null==J||this.currentPage==J?p.setBackgroundImage(this.editor.graph.backgroundImage):null!=J.viewState&&null!=J.viewState&&
p.setBackgroundImage(J.viewState.backgroundImage);p.getGlobalVariable=function(G){return"page"==G&&null!=J?J.getName():"pagenumber"==G?1:C.apply(this,arguments)};document.body.appendChild(p.container);null!=J&&p.model.setRoot(J.root)}}A=null!=A?A:this.getXmlFileData(u,v,F,S);L=null!=L?L:this.getCurrentFile();d=this.createFileData(A,p,L,window.location.href,d,g,n,t,u,H,F);p!=this.editor.graph&&p.container.parentNode.removeChild(p.container);return d};EditorUi.prototype.getHtml=function(d,g,n,t,u,v){v=