Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c){var e=f.apply(this,arguments);if(null==e)try{var g=c.indexOf("&lt;mxfile ");if(0<=g){var q=c.lastIndexOf("&lt;/mxfile&gt;");q>g&&(e=c.substring(g,q+15).replace(/&gt;/g,">").replace(/&lt;/g,"<").replace(/\\&quot;/g,'"').replace(/\n/g,""))}else{var p=mxUtils.parseXml(c),t=this.editor.extractGraphModel(p.documentElement,null!=this.pages||"hidden"==this.diagramContainer.style.visibility);e=null!=t?mxUtils.getXml(t):""}}catch(x){}return e};EditorUi.prototype.validateFileData=function(c){if(null!=
c&&0<c.length){var e=c.indexOf('<meta charset="utf-8">');0<=e&&(c=c.slice(0,e)+'<meta charset="utf-8"/>'+c.slice(e+23-1,c.length));c=Graph.zapGremlins(c)}return c};EditorUi.prototype.replaceFileData=function(c){c=this.validateFileData(c);c=null!=c&&0<c.length?mxUtils.parseXml(c).documentElement:null;var e=null!=c?this.editor.extractGraphModel(c,!0):null;null!=e&&(c=e);if(null!=c){e=this.editor.graph;e.model.beginUpdate();try{var g=null!=this.pages?this.pages.slice():null,q=c.getElementsByTagName("diagram");