Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.duplicatePage=function(b,f){var m=null;try{var d=this.editor.graph;if(d.isEnabled()){d.isEditing()&&d.stopEditing();var u=b.node.cloneNode(!1);u.removeAttribute("id");var v={},E=d.createCellLookup([d.model.root]);m=new DiagramPage(u);m.root=d.cloneCell(d.model.root,null,v);var F=new mxGraphModel;F.prefix=Editor.guid()+"-";F.setRoot(m.root);d.updateCustomLinks(d.createCellMapping(v,E),[m.root]);m.viewState=b==this.currentPage?d.getViewState():b.viewState;this.initDiagramNode(m);
m.viewState.scale=1;delete m.viewState.scrollLeft;delete m.viewState.scrollTop;delete m.viewState.currentRoot;delete m.viewState.defaultParent;m.setName(f);m=this.insertPage(m,mxUtils.indexOf(this.pages,b)+1)}}catch(L){this.handleError(L)}return m};EditorUi.prototype.initDiagramNode=function(b){var f=(new mxCodec(mxUtils.createXmlDocument())).encode(new mxGraphModel(b.root));this.editor.graph.saveViewState(b.viewState,f);mxUtils.setTextContent(b.node,Graph.compressNode(f))};