Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(0<T.length){if(null!=this.pageId)for(var F=0;F<T.length;F++)if(this.pageId==T[F].getAttribute("id")){this.currentPage=F;break}var K=this.graph.getGlobalVariable;N=this;this.graph.getGlobalVariable=function(k){var v=T[N.currentPage];return"page"==k?v.getAttribute("name")||"Page-"+(N.currentPage+1):"pagenumber"==k?N.currentPage+1:"pagecount"==k?T.length:K.apply(this,arguments)}}}this.diagrams=[];var R=null;this.selectPage=function(k){this.handlingResize||(this.currentPage=mxUtils.mod(k,this.diagrams.length),
this.updateGraphXml(Editor.parseDiagramNode(this.diagrams[this.currentPage])))};this.selectPageById=function(k){k=this.getIndexById(k);var v=0<=k;v&&this.selectPage(k);return v};F=mxUtils.bind(this,function(){if(null==this.xmlNode||"mxfile"!=this.xmlNode.nodeName)this.diagrams=[];this.xmlNode!=R&&(this.diagrams=this.xmlNode.getElementsByTagName("diagram"),R=this.xmlNode)});var W=this.graph.setBackgroundImage;this.graph.setBackgroundImage=function(k){if(null!=k&&Graph.isPageLink(k.src)){var v=k.src,