Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){try{if(da>=ja.length)ca();else{var la=ja[da];StorageFile.getFileContent(this,la,mxUtils.bind(this,function(X){null==X||".scratchpad"==la&&X==this.emptyLibraryXml?M.contentWindow.postMessage(JSON.stringify({action:"remoteInvoke",funtionName:"getLocalStorageFile",functionArgs:[la]}),"*"):ia()}),ia)}}catch(X){console.log(X)}}),aa=mxUtils.bind(this,function(la){try{this.setDatabaseItem(null,[{title:la.title,size:la.data.length,lastModified:Date.now(),type:la.isLib?"L":"F"},{title:la.title,
data:la.data}],ia,ia,["filesInfo","files"])}catch(X){console.log(X)}});F=mxUtils.bind(this,function(la){try{if(la.source==M.contentWindow){var X={};try{X=JSON.parse(la.data)}catch(P){}"init"==X.event?(M.contentWindow.postMessage(JSON.stringify({action:"remoteInvokeReady"}),"*"),M.contentWindow.postMessage(JSON.stringify({action:"remoteInvoke",funtionName:"getLocalStorageFileNames"}),"*")):"remoteInvokeResponse"!=X.event||H||(O?null!=X.resp&&0<X.resp.length&&null!=X.resp[0]?(ja=X.resp[0],O=!1,ma()):