Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(c){var e=f.apply(this,arguments);if(null==e)try{var g=c.indexOf("&lt;mxfile ");if(0<=g){var q=c.lastIndexOf("&lt;/mxfile&gt;");q>g&&(e=c.substring(g,q+15).replace(/&gt;/g,">").replace(/&lt;/g,"<").replace(/\\&quot;/g,'"').replace(/\n/g,""))}else{var p=mxUtils.parseXml(c),t=this.editor.extractGraphModel(p.documentElement,null!=this.pages||"hidden"==this.diagramContainer.style.visibility);e=null!=t?mxUtils.getXml(t):""}}catch(x){}return e};EditorUi.prototype.validateFileData=function(c){if(null!=