Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DrawioFile.prototype.reloadFile=function(b,e){try{this.ui.spinner.stop();var g=mxUtils.bind(this,function(){EditorUi.debug("DrawioFile.reloadFile",[this],"hash",this.getHash(),"modified",this.isModified(),"backupPatch",this.backupPatch);this.stats.fileReloaded++;if(""==this.getHash())this.mergeLatestVersion(null!=this.backupPatch?[this.backupPatch]:null,mxUtils.bind(this,function(){this.backupPatch=null;null!=b&&b()}),e);else{var n=this.ui.editor.graph,y=n.getSelectionCells(),q=n.getViewState(),E=
this.ui.currentPage;this.ui.loadFile(this.getHash(),!0,null,mxUtils.bind(this,function(){if(null==this.ui.fileLoadedError){this.ui.restoreViewState(E,q,y);null!=this.backupPatch&&this.patch([this.backupPatch]);var N=this.ui.getCurrentFile();null!=N&&(N.stats=this.stats);null!=b&&b()}}),!0)}});this.isModified()&&null==this.backupPatch?this.ui.confirm(mxResources.get("allChangesLost"),mxUtils.bind(this,function(){this.handleFileSuccess("manual"==DrawioFile.SYNC)}),g,mxResources.get("cancel"),mxResources.get("discardChanges")):
g()}catch(n){null!=e&&e(n)}};DrawioFile.prototype.mergeLatestVersion=function(b,e,g){this.getLatestVersion(mxUtils.bind(this,function(n){this.ui.editor.graph.model.beginUpdate();try{this.ui.replaceFileData(n.getData()),null!=b&&this.patch(b)}finally{this.ui.editor.graph.model.endUpdate()}this.inConflictState=this.invalidChecksum=!1;this.setDescriptor(n.getDescriptor());this.descriptorChanged();null!=e&&e()}),g)};